Disclosure to the Public by Entities Pillar III

Data as at 31 December 2018 This document is a courtesy translation into English of the document in Italian approved by the Board of Directors. In case of any discrepancies or doubts between the English and the Italian versions of the Report, the Italian version prevails. Contents

Introduction ...... 4 Risk management objectives and policies ...... 7 Scope of application...... 61 Own Funds ...... 70 Capital Requirements...... 85 Credit Risk - General information regarding all banks ...... 97 Credit Risk - standard approach...... 113 Credit Risk - IRB approach...... 116 Risk Mitigation Techniques ...... 140 Counterparty Risk...... 144 Securitisation and Covered Bond Transactions...... 156 Market risk - IMA approach ...... 167 Equity exposures...... 177 Operational risk ...... 182 Interest rate risk on positions in the banking book ...... 185 Liquidity - Liquidity Coverage ratio...... 188 Encumbered assets...... 191 Financial Leverage...... 194 Remuneration and incentive systems and practices ...... 199 Glossary...... 276 Declaration of the Risk Unit Manager...... 281 Declaration of the Financial Reporting Manager...... 282

3 Introduction

Periodic disclosure provided to the market regarding the Group’s capital adequacy (Pillar 3 Disclosure) Supervisory regulations require that banks fulfil specific obligations to publish information regarding their capital adequacy, exposure to risks and the general characteristics of the systems for identifying, measuring and managing these risks, and to supply information on remuneration practices and policies in order to strengthen the role of market discipline.

Since 1 January 2014, the prudential supervisory provisions applicable to banks have been contained in Circular 285 of 17 December 2013, the publication of which was functional to the start of application of the EU legislation (CRR Regulation EU no. 575/2013 and CRD IV Directive 2013/36/EU) containing the reforms of the Basel Committee accords (Basel 3).

The subject, as specifically noted in Part II, Chapter 13 of the Circular, is directly regulated by the CRR (Part Eight and Part Ten, Title I, Chapter 3) and by the European Commission regulations containing the technical rules for regulation or enactment. According to the CRR Regulation, banks must publish the information required at least once a year.

It is up to the same entities to assess, on the basis of the significant aspects of their activities, the need to publish some or all of the information required more frequently, in particular on the composition of Own Funds and capital requirements.

The Banco BPM Group, created on 1 January 2017 by the merger between former banking groups and , already authorised by the Supervisory Authority to use internal methods to calculate capital requirements for credit risk (former Banco Popolare and from 31 March 2018, BPM spa, merged by incorporation with the Parent Company Banco BPM as of 26 November 2018), market risk (former Banco Popolare, Banca Aletti and Banca Akros) and operational risk (former Banco Popolare, Banca Aletti, SGS and BP Property) believes it is appropriate to continue preparing interim reports, also in accordance with the EBA guidelines ("Guidelines on materiality, proprietary and confidentiality and on disclosure frequency under Articles 432(1), 432(2) and 433 of Regulation (EU) No 575/2013").

The present document, entitled Disclosure to the Public by Entities, constitutes fulfilment of the aforementioned regulatory obligations and is drawn up on a consolidated basis. All qualitative and quantitative information at 31 December 2018 is provided below.

Information relative to the Banco BPM Group is also structured in the light of the indications and guidelines issued with regards to the Disclosure by the EBA over the last few years. With the 22nd update to Bank of Italy Circular 285/2013, these guidelines became an integral part of supervisory regulations.

In particular, these refer to the following areas:

 EBA/GL/2014/14, on the relevance, exclusivity, confidentiality and frequency of the disclosure, pursuant to articles 432, paragraphs, 1, 2 and 433 of Regulation EU 575/2013 ("CRR"); 4  EBA/GL/2016/11, on disclosure obligations pursuant to part eight of the CRR;

 EBA/GL/2017/01, on the disclosure of the liquidity coverage ratio, adding to the disclosure on liquidity risk management, pursuant to article 435 of the CRR;

 EBA/GL/2018/01, on uniform disclosures pursuant to article 473-bis of the CRR, with regards to transitional provisions aimed at attenuating the impact of the introduction of IFRS 9 on own funds.

In compliance with the aforementioned disclosure and frequency obligations, the present document is published on the website www.bancobpm.it in the Investor Relations section.

All amounts shown in the tables below are stated in thousands of euro, unless otherwise indicated.

Treatment of profit for the purposes of preparing the Pillar 3 disclosure Based on the provisions of Art. 26, paragraph 2 of EU Regulation no. 575/2013 of 26 June 2013 (CRR), the inclusion of profits in Common Equity Tier 1 Capital (CET1) is subject to the prior permission of the competent authorities (the ECB), which requires these profits to be verified by the auditing firm.

Bank figures and capital ratios illustrated in this disclosure include the economic result at the end of financial year 2018.

5 Capital adequacy ratios at 31 December 2018

Own Funds and capital adequacy ratios 31/12/2018 31/12/2017

A. Capital buffers and requirements Own funds Common Equity Tier 1 Capital (CET1) 7,754,246 9,378,682 Additional Tier 1 Capital (AT1) 133,891 229,660 Total Tier 1 Capital 7,888,137 9,608,342 Tier 2 Capital (T 2) 1,553,803 1,935,926 TOTAL OWN FUNDS 9,441,940 11,544,268

Risk-weighted assets Credit and counterparty risks 56,177,956 67,381,808 Credit valuation adjustment risk 180,633 319,533 Settlement risk 64,884 21,347 Market risk 1,858,688 2,573,112 Operational risk 5,872,577 5,600,641 Other calculation elements 169,328 0 RISK-WEIGHTED ASSETS 64,324,066 75,896,441

B. Capital adequacy ratios (%) B.1 Common Equity Tier 1 Ratio 12.1% 12.4% B.2 Tier 1 Ratio 12.3% 12.7% B.3 Total Capital Ratio 14.7% 15.2%

Own Funds and the capital ratios as at 31 December 2018 have been calculated by applying the provisions of the Bank of Italy and the European Central Bank in accordance with Basel III regulations1.

At 31 December 2018, own funds totalled € 9,442 million against weighted assets of € 64,324 million, mostly arising from credit and counterparty risks and, to a lesser extent, operational and market risks.

The Total Capital Ratio stood at 14.7%; the Group Tier 1 Ratio (Tier 1 Capital to RWAs) stood at 12.3%. The Common Equity Tier 1 Ratio (Common Equity Tier 1 to RWAs) was 12.1%.

1 More specifically, the data has been calculated with consideration for the current legislation and the interpretations issued prior to 6 February 2019, the date on which the Board of Directors approved the quarterly equity and economic statements at 31 December 2018. 6 Risk management objectives and policies

Introduction The Banco BPM Group and the companies that belong to the same seek to respect criteria of prudence and reduced exposure to risk in their business activities, as regards:

i. the need for stability in the exercise of banking activities;

ii. sustainable development in the areas it operates in;

iii. their investors’ profile.

The process to manage and control the risks assumed by the Group is coordinated by Banco BPM Spa in its dual role as Parent Company and the company where all of the main functions of common interest to the entire Group or to some Subsidiaries are centralised, based on specific service agreements. This is to ensure harmonised and consistent management at the Group level, guaranteeing effective customer relations, service quality and sound risk management.

The fundamental role in controlling risks deriving from Group activities falls to the Parent Company's Board of Directors, which establishes strategic guidelines, approves risk management policies, assesses the degree of efficiency and adequacy of the internal control system and guarantees a suitable level of internal communication and discussion. Pursuant to the Banco BPM spa By-law, the Board of Directors has established an Internal Control and Risk Committee, which provides support to the Board with regards to internal control risks and systems, with responsibility for overseeing the entire Group.

Additionally, specific Steering Committees have been set up within the Parent Company which, in some cases, involve the presence of management from subsidiaries as members of these steering committees. In particular, worthy of note in terms of risk management and monitoring are the Risk Committee, Finance Committee and the New Products and Markets Committee.

The Banco BPM Group’s total risk appetite is determined using the Risk Appetite Framework, which is governed by the Risk Appetite Framework (RAF) Regulation.

With a view to suitably pursuing its objectives - with the overall objective of sound and prudential management - in addition to specific organisational safeguards (regulations, systems, processes, resources etc.) and the availability of adequate capital, the risk governance process is also based on a system that encompasses company values, as well as on the effectiveness and the efficiency of the chosen organisational model, which help contain exposure to risk and/or to minimise the impact.

In particular, development and dissemination of an integrated risk culture at all levels is envisaged, in relation to the various types of risks and extended throughout the entire Group. In fact, training programs are developed and implemented to increase employee awareness in terms of responsibilities relative to risks, so as to not limit the risk management 7 process to specialists or audit functions. This makes it possible to create an environment favourable to guaranteeing that significant risks and factors which could increase them are promptly identified and managed.

Organisation of Risk Governance

Board of Directors With a view to being able to count on an adequate system to control and manage business risks, the Board of Directors, the Internal Audit and Risks Committee and the Board of Statutory Auditors, which oversee the functioning of the internal audit system, have been assigned the following tasks, established in the current Articles of Association.

Pursuant to article 24.2.2, letter d) of the By-law, the Board of Directors is reserved the non- delegable responsibility for defining and approving: (i) the Risk Appetite Framework; (ii) the guidelines of the internal control system, so that the main risks relating to the Company and its subsidiaries and to transactions of greater significance are correctly identified, as well as adequately measured, managed and monitored, also establishing criteria relating to the compatibility of said risks with the sound and correct management of the Company; the Board of Directors is also responsible for approving (i) the establishment of corporate audit functions, assigning the relative tasks, responsibilities as well as the procedures for the coordination and collaboration of the same, the information flows between functions and between the latter and corporate bodies; (ii) the adoption of internal risk measurement systems.

When drawing up the strategic, business and financial plans, the Board of Directors establishes the nature and the level of risk that are compatible with the sound and correct management of the Company and the Group.

Definition of the Group's risk appetite occurs annually as part of the Group's Risk Appetite Process.

In particular, in 2018 the Group's Risk Appetite Framework was implemented and refined, with the aim of defining the Banco BPM Group's risk appetite.

In addition, authorisation was received from the European Central Bank (i) to use internal risk management systems (AIRB models) to measure capital requirements relative to consolidated credit risk, as well as (ii) to use an internal model to calculate market risk capital requirements.

For assessment and consulting activities relating to the internal audits and the monitoring of corporate risk management, the Board of Directors has the support of the Internal Audit and Risks Committee (hereinafter also “Audit Committee”), set up within the same.

For further details on the activities performed by the Board of Directors, please refer to the “Report on corporate governance and ownership structures - 2018” published on the company website.

8 Optimal composition of the Board of Directors The candidates for the position of Board Member on the first Board of Directors of Banco BPM were indicated in the proposed merger drawn up and approved by the management bodies of Banco Popolare and of BPM pursuant to art. 2501 of the Italian Civil Code and submitted to the approval of the respective Shareholders’ Meetings pursuant to art. 2502 of the Italian Civil Code, on 15 October 2016.

The optimal qualitative-quantitative composition of the Board of Directors was established by the management bodies of Banco Popolare and of BPM on 24 May 2016, in a document entitled “Preliminary analysis of the qualitative-quantitative compositions of the Board of Directors and of the theoretical profile of candidates for the position of Board Member of the company resulting from the merger between Banco Popolare - Società Cooperativa and Banca Popolare di Milano S.c.ar.l.” (“BoD Composition Analysis Document”), made available to the Shareholders’ Meetings as above, requested to approve the planned merger.

At the meeting on 30 January 2017, the Board of Directors of Banco BPM deemed the composition of the current Board of Directors to be in line with the qualitative-quantitative optimal composition for the outlined in the Board of Directors Composition Analysis Document.

Quantitative composition of the Board of Directors The composition of the Board of Directors is of central importance for the effective fulfilment of the crucial duties assigned to this body by law, Supervisory Provisions and the Articles of Association.

The number of members must be proportionate to the size and complexity of the bank’s organisational structure, in order to effectively exercise management and control over all company operations. Therefore, it should not be too large or, conversely, too small.

With reference to its numerical composition, the Banco BPM By-law establish that the Board of Directors be composed: (i) until the End of the First Term in Office (date of the Shareholders’ Meeting called to approve the financial statements for FY 2019), by 19 (nineteen) members; and (ii) after said Term in Office, by 15 (fifteen) members.

It should be noted that the prospect of a Board of Directors initially composed of 19 members is aimed at ensuring that, at least during its first term, the Group can benefit from the contributions of the larger number of individuals able to provide essential knowledge during the establishment of the new group.

Additionally, the initial size of the Board is to be considered expedient, given that it favours integration between the groups and gives the merger an inclusive value.

Terms have a duration of three financial years, and at the end of the transitional period the Board of Directors will fall to 15 members, in line with that established in the Supervisory Provisions.

9 Qualitative composition of the Board of Directors In terms of quality, the members of the Board of Directors must meet requirements of professionalism proportionate to the bank’s operating complexity and size - without prejudice to the fulfilment of requirements for bank representatives pursuant to Art. 26 of Italian Legislative Decree 385/1993 - taking into consideration the size and specific characteristics of the sector in which Banco BPM operates.

This being said, in order to identify the qualitative composition considered optimal in light of the specified objectives, the theoretical profiles (including characteristics of professionalism and, if applicable, independence) of candidates for the role of Board Member are outlined in the BoD Composition Analysis Document, and are based on the following criteria: - extensive and diversified expertise, with a view to ensuring that the management body of Banco BPM has a balanced combination of profiles and experience that encourage, in view of the challenges that the Bank will be facing, further areas of expertise; - significant and consolidated business and/or banking experience; - an equal number of independent directors with a view to ensuring adequate debate both within the Board of Directors and in its internal committees; - balance between genders (Law 120/2011).

A) Skills and experience

In order to ensure the optimal qualitative composition, the Board of Directors must have widespread and diversified expertise, both from a managerial and professional perspective.

To that end, recall that article 20.1.4 of the Banco BPM By-law establishes that - without prejudice to the various and/or additional requirements established in the pro tempore regulations in effect - all members of the Board of Directors must have adequate experience, obtained through at least five years of administrative and/or management and/or audit activities, in Italy or abroad, or at least three years as a chairperson, chief executive officer and/or general manager, at: (i) banks, financial companies, asset management companies; or (ii) insurance companies; or (iii) companies with shares traded on a regulated market in Italy or abroad; or (iv) companies other than those mentioned above which, individually or at a consolidated group level, have turnover exceeding € 100 million, as resulting from the most recently approved financial statements. Candidates who do not have this professional experience may be appointed to the Board of Directors, provided they do not add up to a majority of members, provided that: (a) they are or have been tenured university professors for at least five years in legal, corporate, economic or mathematics/statistics/corporate engineering faculties; or (b) are or have been registered for at least a year in the Professional Association of Chartered Accountants, Notaries or Lawyers; or (c) have covered for at least three years administrative level roles in public administrations or independent authorities with institutional competence in matters pertinent to banking, insurance or financial activities.

10 Therefore, without prejudice to the requirements of professionalism required by the law (primary and secondary) and by the Articles of Association of Banco BPM for the award of the position, with regard to requirements of experience envisaged by the articles of association and taking into account the recommendations of the European Banking Authority, to ensure the proper functioning of the management body, the directors and, in particular, in accordance with the BoD Composition Analysis Document, the members other than “executive directors” must have good knowledge and experience in at least one of the areas of expertise indicated below: - knowledge of the banking sector and of the methods to measure, manage and control the risks relating to the exercise of banking business activities: acquired through experience in administration, top management, managerial and/or control in the financial sector and/or university teaching; - experience of business management and of company organisation: acquired through an activity of administration, top management, managerial and/or control in enterprises or groups of substantial economic size; - ability to understand and interpret financial statement data of a financial institution: acquired through experience in administration and control in enterprises in the financial sector or through professional activities or university teaching; - corporate expertise (audit, compliance, legal, corporate, etc.) acquired through experience in enterprises of a significant size, or through professional activities or university teaching; - knowledge of the regulation of financial activities: acquired through specific experience in financial enterprises or supervisory bodies, or through professional activities or university teaching; - knowledge of the global dynamics of the economic-financial system: acquired though significant experience gained in financial institutions, research entities, research offices of enterprises or of international bodies, supervisory authorities.

Furthermore, in order to fully cover all of the areas of expertise identified above, to facilitate the assignment of Board of Directors’ committee positions as well as increase the degree of knowledge in taking board decisions, in accordance with the BoD Composition Analysis Document, each area of expertise identified above should be represented in the Board as a whole.

The Regulations of the Internal Committees, approved by the Board of Directors, also envisage that at least one member of the: i. Audit and Risks Committee must have adequate experience in accounting and financial areas or in risk management; ii. Remuneration Committee must have adequate knowledge and experience in “financial matters or remuneration policies”.

11 B) Appropriate number of Independent Directors

In relation to independence requirements, recall that article 147-ter, last paragraph, Legislative Decree 58 of 24 February 1998 (Consolidated Finance Law - CFL) establishes that, where the Board of Directors has more than seven members, at least two of the directors must fulfil the requirements of independence established for statutory auditors by art. 148, paragraph 3, CFL.

The Corporate Governance Code of Borsa Italiana envisages that “the Boards of Directors of issuers belonging to the FTSE-Mib must consist of at least one-third of independent directors and that if this corresponds to a non-whole number, the latter may be rounded down”.

The Supervisory Provisions envisage that “at least a quarter of members must possess independence requirements. They must possess adequate professionalism and authority to ensure a high level of internal debate within the body they belong to and to make a significant contribution to the decision-making process of the same”.

Articles 20.1.5 and 20.1.6 of the Banco BPM By-law establish, based on best practices, a number of directors holding independence requirements that exceeds the minimum established in the regulatory provisions and the Corporate Governance Code.

In fact, they establish that at least 9 (nine) Directors, for as long as the Board of Directors shall consist of 19 directors, and at least 7 (seven) Directors, starting from when said Board will consist of 15 directors, must be independent directors, by which meaning Directors that do not have nor have recently had, directly or indirectly, relations of a professional, equity, personal or other such relation with Banco BPM or subjects associated with the same, such as to affect the autonomy of their opinions.

To that end, in compliance with the notion of independent director indicated in the Banco BPM By-law2, a Director is in any case not considered as an independent director if any one of the following hypotheses occurs: a) if, directly or indirectly, also through subsidiaries, trust companies or third parties, he/she controls Banco BPM, or is able to exercise a significant influence over the same, or participates in a shareholders’ agreement through which one or more parties may exercise control or a significant influence over Banco BPM; b) if he/she is, or has been a significant representative in the previous three financial years - meaning by such: the Chairman of the Board of Directors, the “executive directors” and “executives with strategic responsibilities” - of Banco BPM, of a subsidiary of the same with strategic significance or of a company under joint control with Banco BPM, or of a company or an entity which, also together with others through a shareholders’ agreement, controls Banco BPM or is able to exercise significant influence over the same;

2The Supervisory Provisions establish that, “until the issue of regulations implementing Art. 26 of the Consolidated Banking Law, banks shall define within their own Articles of Association a single definition of independent directors, consistent with the role they are assigned, and shall ensure the effective application thereof”. 12 c) if he/she holds the position of executive director in another company in which an executive director of Banco BPM is also a director, even if non-executive; d) if he/she is a partner, director or employee of a company or of an entity belonging to the network of the company assigned the external auditing of Banco BPM; e) if, in the previous three financial years, he/she has received a significant additional fixed remuneration (with respect to the “fixed” emolument of a non-executive director of Banco BPM, the remuneration for participation in Banco BPM Board committees, any attendance fee for presence at meetings) from the Company or from a subsidiary or Parent Company, including therein any participation in incentive plans linked to company performance, also share-based plans; f) if she/he has, or has had, directly or indirectly (for example through subsidiaries or those in which he/she is a prominent representative, or as partner of a professional studio or of a consultancy company), a significant professional, equity, business or financial relationship in the previous financial year:

- with Banco BPM, a subsidiary of the same or with any of the respective prominent representatives;

- with a party which, also jointly with others through a shareholders’ agreement, controls Banco BPM, or - in the case of a company or entity - with the relative prominent representatives;

- with companies under joint control with Banco BPM; or is, or was, in the previous three financial years, an employee, external collaborator or engaged in a continuous working relationship with one of the aforementioned parties; g) if he/she is a close family member (meaning by such, the spouse, as long as not legally separated, relative or similar to the fourth degree of kinship, the cohabitant as if married and cohabitant family members) of the directors of the New Parent Company or of the directors of companies controlled by the same, of companies that control it and of those subject to joint control; h) if she/he is a close family member of a director of Banco BMP or a director of a subsidiary of the same, its Parent Company or one subject to joint control;

I) if he/she falls into any other category that fails to meet the requirement of independence envisaged by the legislation in force at the time.

At its meeting on 1 January 2017, the Board of Directors approved the criteria to determine the significance of the cases indicated in article 20.1.6, paragraph 1, letters e) and f) of the By-law.

For full details on independence requirements, please see the “Report on corporate governance and ownership structures - 2018” published on the Banco BPM website.

13 C) Balance between genders

In compliance with legal and regulatory provisions governing equal access to the management and control bodies of companies listed in regulated markets (Italian Law no. 120 of 12 July 2011 and Consob Resolution no. 18098 of 8 February 2012) and in compliance with the Articles of Association, up until the date of the Shareholders’ Meeting called to approve the financial statements for FY 2019, at least 7 (seven) members of the Board of Directors of Banco BPM must belong to the less represented gender.

In any event, the same Articles of Association of Banco BPM envisages in article 20.1.2 that the composition of the Board of Directors must guarantee, in compliance with the provisions of Italian Law no. 120 of 12 July 2011 and any subsequent amendments, as well as by legislation and regulations in force at the time, a balance between genders for the period envisaged by the same law.

Role and availability of directors To correctly carry out the duties assigned to them, all Board Members of Banco BPM are expected to:

- be fully aware of their strategic role and the powers and obligations inherent in the functions carried out;

- have adequate authority for the role to be covered;

- dedicate adequate time and resources to their overall role, also taking into account any roles within internal Committees, guaranteeing consistent attendance and proactivity at meetings, and consulting materials supporting agenda items3.

The specific skills and authority of the Board Members must in any case be such so as to guarantee a significant contribution to board discussions to contribute to taking decisions in line with the company’s interest.

Pursuant to art. 20.1.6 of the Articles of Association of Banco BPM, the following are considered “executive directors”:

i. the chief executive officer, directors to whom the Board of Directors have granted powers pursuant to article 2381, paragraph two of the Italian Civil Code (and article 24.2.2, letter g of the By-law) and directors who de facto carry out roles pertinent to the current management of the company for which they serve as directors;

ii. directors who are members of an executive committee;

iii. members of a board of directors that plays a supervisory role in the company managed, overseeing specific areas of company operations.

3 To that end, the Board of Directors approved, with the support of the Appointments Committee and after hearing from the Board of Statutory Auditors, in line with that established in the current Bank of Italy supervisory provisions, the Borsa Italian Corporate Governance code and the current provisions of the Bylaws, and taking into account that established in CRD4 (Directive 2013/36/EU), the "Regulations on the limits to the number of positions held", in order to identify operating criteria to determine a limit on the total number of positions that can be simultaneously held by members of the Board of Directors, Board of Statutory Auditors and general management of the banks in the Banco BPM Group. The Regulations can be found on the company website. 14 The connotation of “executive”, for the members of the Board of Directors, in the event that they are also members of the Executive Committee, is connected, in terms of the Corporate Governance Code of Borsa Italiana, with the required frequency of Committee meetings and the subject of the relative resolutions. In addition, the Bank of Italy’s Supervisory Provisions define as an “executive member”, inter alia, all directors on the Executive Committee.

It should also be noted that the Chairman of the Board of Directors is considered as “non- executive” insofar as he/she does not have delegations of management and is not a member of the Executive Committee, participating at the meetings of the same, without voting rights, for the sole purpose of ensuring an effective exchange of information between the strategic supervisory function and the management one (art. 26.3 of the Articles of Association).

It should also be noted that, pursuant to art. 20.3.2 of the Articles of Association of Banco BPM - without prejudice to any other reasons for incompatibility envisaged by the legislation in force at the time - persons that become members of management bodies or employees of companies or belong to groups whose business activities are in competition with those of Banco BPM or the Group to which the same belongs, with the exception of central trade institutions or investee companies held directly or indirectly by Banco BPM, may not be appointed to the position, and if appointed, will be removed from office.

The above prohibition is not applicable when the participation in management bodies of other banks relates to the representation of trade organisations or associations of the banking system.

Number of director, management and control positions held by members of the management body The table below shows the total number of director, management and control positions held by each member of the Board of Directors in other listed, financial, banking, insurance or significantly sized companies; the latter have been identified in light of the provisions set forth in the “Regulations on the limits to the number of positions that may be held by Directors of the Banco BPM Group” adopted by Banco BPM.

The detailed list of positions is attached to the “Report on corporate governance and ownership structures - 2018” published on the company website.

No. other Surname and Name Position offices Chairperson Carlo Fratta Pasini 0 Director Deputy Chairman Senior Mauro Paoloni 4 Director Deputy Chairman Guido Castelloti 0 Director Deputy Chairman Maurizio Comoli 5 Director

15 No. other Surname and Name Position offices Chief Executive Officer Giuseppe Castagna 1 Director Mario Anolli Director 3

Michele Cerqua Director 0

Rita Laura D'Ecclesia Director 0

Frascarolo Carlo Director 3

Paola Galbiati Director 1

Cristina Galeotti Director 5

Marisa Golo Director 0

Piero Lonardi Director 3

Pedrollo Giulio Director 5

Fabio Ravanelli Director 4

Pier Francesco Saviotti Director 2

Manuela Soffientini Director 2

Costanza Torricelli Director 0

Cristina Zucchetti Director 5

Managing Director In accordance with the provisions of art. 7.P.3 of the Corporate Governance Code of Borsa Italiana, the Board of Directors resolved, at the meeting held on 10 January 2017, to appoint the Managing Director as the “Director in charge of the internal audit and risk management system” until the end of his/her term in office.

The specific duties - envisaged by art. 7.C.4 - that the Code assigns to said position, are illustrated below:

- ensure the identification of the main company risks, taking into account the characteristics of the activities performed by Banco BPM and its subsidiaries, and periodically submit them to the examination of the Board of Directors;

- implement the guidelines established by the Board of Directors, organising the design, formation and management of the internal audit and risk management system, and continuously verifying its overall adequacy and effectiveness;

- handle the adaptation of said system to changes in operating conditions and in the legislative and regulatory panorama.

In addition, the following powers and obligations are assigned:

- the power to ask the Audit function to conduct audits on specific operating areas and on compliance with internal rules and procedures when performing company transactions, promptly informing the Chairman of the Board of Directors, the

16 Chairman of the Audit Committee and the Chairman of the Board of Statutory Auditors;

- the obligation to promptly inform the Audit Committee (or the Board of Directors) regarding problems and critical areas that have emerged during the performance of his/her duties or which he/she has been informed of, so that the Committee (or Board) may adopt the appropriate measures.

For further details on the activities performed by the Managing Director, please refer to the “Report on corporate governance and ownership structures - 2018” published on the company website.

Board of Statutory Auditors Pursuant to article 35.1 of the By-law, the Board of Statutory Auditors consists of five standing and three alternate auditors, who hold office for three years, expiring on the date of the Shareholders' Meeting called for the approval of the financial statements relative to the last financial year of their office, and can be reappointed. Auditors must hold the requirements of eligibility, independence, professionalism and integrity as established in the norms in effect at the time.

In compliance with article 35.2 of the By-law, the composition of the Board of Statutory Auditors must ensure balance between the genders based on that established in Italian Law 120 of 12 July 2011, as amended, as well as rules and regulations in force at the time for the period envisaged under the same law.

In particular, in compliance with the legal and regulatory provisions which govern equal access to the administrative and auditing bodies of companies listed on regulated markets (Italian Law 120 of 12 July 2011, CONSOB Resolution 18098 of 8 February 2012 and the Borsa Italian Corporate Governance Code), the less represented gender must hold at least one third of the positions on the Board of Statutory Auditors.

Pursuant to article 35.3 of the By-law, limits on the total number of administrative and auditing positions established in the CONSOB regulations apply to members of the Board of Statutory Auditors, as well as any other applicable provision.

Additionally, based on that envisaged in article 35.4 of the By-law: (i) Auditors cannot hold roles in bodies other than those with auditing responsibilities within other Group companies, or with companies with which the Company holds, even indirectly, a strategic equity investment (even if not part of the Group); and (ii) candidates who hold the role of Director, Manager or Functionary in a company or entity which directly or indirectly exercises banking activities in competition with that of the Company or the relative Group cannot be appointed or if appointed shall be removed from office, with the exception of trade bodies.

Pursuant to article 38.1 of the Bylaws, the Board of Statutory Auditors carries out the duties and exercises the control functions laid down by legislation in force at the time, and particularly it supervises:

a. observance of laws, regulations and the Articles of Association as well as compliance with the principles of proper administration; 17 b. the adequacy of the Company’s organisational and administrative/accounting structure and the financial reporting process, within its scope of responsibility;

c. the effectiveness and adequacy of the risk management and control system, as well as the internal audit system, as well as the functioning and adequacy of the overall internal control system;

d. the separate and consolidated accounts auditing process;

e. the procedures for the proper implementation of the rules of corporate governance that the Company states it complies with;

f. the adequacy of the orders imparted by the Company to its subsidiaries in the exercise of supervision and coordination activities;

g. the independence of the independent auditors, particularly as regards the provision of non-auditing services.

Additionally, pursuant to article 19 of Legislative Decree 39/2010 (as amended by Legislative Decree 135/2016), the Board of Statutory Auditors is assigned the functions of the Internal Control and Audit Committee.

In any case, the Board of Statutory Auditors is invested with the powers established in the regulatory provisions and reports to the supervisory authorities pursuant to the regulations in effect at the time.

The Board of Statutory Auditors informs the Board of Directors of flaws and irregularities that may be identified, requests the adoption of appropriate corrective measures and verifies their effectiveness over time.

Auditors also have the right to begin, at any time, including individually, actions to inspect and audit, as well as to ask for information from directors, including with reference to subsidiaries, regarding the condition of corporate operations or given business, or to send the same requests for information directly to the administrative and control bodies of the subsidiaries.

The Board of Statutory Auditors may also exchange information with the corresponding bodies within subsidiaries with regards to administration and control systems and the general status of corporate activities.

For further details on the activities performed by the Board of Statutory Auditors, please refer to the “Report on corporate governance and ownership structures - 2018” published on the company website.

Group Internal Audit and Risks Committee Pursuant to art. 24.4.1 of the Articles of Association, the Board of Directors establishes an Internal Audit and Risks Committee within the same, approving the relative Regulations that establish the scope and the functioning of said committee in compliance with supervisory provisions.

The Bank's By-law establish that the Internal Audit and Risks Committee consists of four Directors, all non-executive and the majority of which (including the individual appointed as 18 Chairperson) holding the independence requirements established in the By-law. It is also established that the members of the Committee must have knowledge, skills and experience such as to allow them to fully understand and monitor the Group's risk strategies and appetite. At least one member of the Committee must have adequate experience in accounting and financial issues or risk management.

The Internal Audit and Risk Committee, established the Board of Directors resolution of 10 January 2017, consists of the following four Directors as of the reporting date (and until approval of the 2019 financial statements): Mario Anolli (Chairperson), Costanza Torricelli (Deputy Chairperson), Rita Laura D’Ecclesia and Carlo Frascarolo. All members of the Committee are non-executive and independent directors.

The Internal Audit and Risks Committee is charged with the duties envisaged by the supervisory provisions of the Bank of Italy (see, in particular, Part One, Title IV, Chapter 1, Section IV of Circular 285/13), by the Articles of Association as well as by the Corporate Governance Code, in particular performing duties to assist the Board of Directors of the Issuer with regard to risks and the internal audit system, the scope of which applies to the entire Group.

The Committee is responsible, inter alia, for investigation and advisory activities with regard to the scope reserved to the Board of Directors relating to:

- internal audit system;

- risk analysis, measurement, monitoring and management;

- IT accounting structure. In performing its duties, the Committee places particular attention on all activities that are instrumental or necessary for the Board of Directors to be able to correctly and effectively establish the Risk Appetite Framework and risk governance policies.

In compliance with the specific functions envisaged by Supervisory Provisions of the Bank of Italy and by the Borsa Italiana Corporate Governance Code, the Committee also carries out, in accordance with the specific Regulation, the following duties:

- assists the Board of Directors by providing its opinion: i. in establishing the guidelines of the internal audit and risk management system, so that the main risks to which the Company and its subsidiaries are exposed to are correctly identified as well as adequately measured, managed and monitored;

ii. in determining the level of compatibility of said risks with the sound and prudent management of the Company, consistent with the strategic objectives identified;

- provides support to the Board of Directors in the appointment of the Director in charge of the internal audit and risk management system;

- identifies and proposes to the Board of Directors, with the contribution of the Appointments Committee, the Chief Risk Officer, if envisaged, the heads of the

19 corporate audit functions to be appointed and indicates its opinion on the proposal to revoke the same;

- forms an opinion on changes to the organisational structure of the corporate audit functions within the scope of the Board of Directors, on the adequacy of the resources assigned to the same, with respect to the performance of their duties and, without prejudice to the scope of the Remuneration Committee, on the remuneration of the relative managers, in accordance with company policy;

- makes assessments and forms opinions for the Board of Directors on compliance with standards, legislative and regulatory provisions, to which the internal audit system and the company organisation must adhere, and the requirements that must be fulfilled by the company’s audit functions, bringing any weak areas to the attention of the Board of Directors as well as the consequent corrective measures to be implemented (to this end assesses the proposals of the Management Body);

- examines the programmes (including the audit plan) and the annual reports of the corporate audit functions addressed to the Board of Directors in advance, providing its opinion to the same;

- contributes, through assessments and opinions, to the definition of the company outsourcing policy as regards the corporate audit functions;

- supervises the corporate audit functions, verifying that the same correctly comply with the recommendations and the guidelines of the Board of Directors and assists the latter in drawing up the Regulations for the coordination and collaboration of the Audit Functions and Bodies;

- assesses the correct use of accounting standards for the preparation of the separate and consolidated financial statements, to this end coordinating with the manager responsible for preparing the Company’s financial reports and with the Board of Statutory Auditors, also requesting, if deemed appropriate, opinions or information from the parties assigned the independent auditing of the accounts;

- expresses its opinion to the Board of Directors regarding the assessment of the results illustrated by the parties assigned the independent auditing of the accounts in any letter of recommendations and in the report on fundamental matters that arose at the time of the independent audit;

- forms its opinion, and informs the Board of Directors of the same regarding the description, in the report on corporate governance, of the main characteristics of the internal audit and risk management system and on assessments as to the adequacy of the same;

- assesses, on a six-monthly basis, the adequacy of the internal audit and risk management system with respect to the characteristics of the Group and its selected risk appetite, as well as its effectiveness, providing its opinion regarding the same annual assessment conducted by the Board of Directors.

With specific reference to its risk management and control duties, the Committee:

20 - supports the Board of Directors in defining and approving strategic guidelines and policies for risk management. More specifically, as regard the Risk Appetite Framework, in the process to determine the risk appetite, the Committee makes assessments and proposals, in accordance with company regulations, so that the Board of Directors may define and approve the Risk appetite and the Risk tolerance;

- assists the Board of Directors in defining the policies and the processes to assess company activities, including verifying that the price and the conditions of transactions with customers are consistent with the business model and risk strategies;

- provides support to the Board of Directors in verifying the correct implementation of the strategies, the risk governance policies and the Risk Appetite Framework, also by examining the periodic reports on Group risk exposure prepared by the relevant company functions;

- supervises, with the assistance of the relevant internal audit functions, the effective use for management purposes of the internal capital requirement measurement systems (use test) and their compliance with other requirements envisaged by law;

- without prejudice to the responsibilities of the Remuneration Committee, verifies that the incentives underlying the remuneration and incentive system are consistent with the Risk Appetite Framework.

The Committee reports to the Board of Directors when necessary, through its Chairman, on the outcome of the activities performed, as well as, at least every six months, at the time of the approval of the annual and interim financial statements, prepares a specific report on the activities performed and on the adequacy of the internal audit and risk management system.

The Committee must structure the execution of its tasks around the standards of autonomy and independence. To this end, it must be granted autonomous powers of initiative and, to effectively perform its duties, it may carry out audit and inspection activities within all areas of Group activities.

In performing its duties, the Committee is generally assisted by the company’s internal control functions and, in particular, by the Internal Audit Function, the Chief Risk Officer, and, where envisaged, by the Risk Control Function, the Compliance Function, the Internal Validation Function and the Anti-Money Laundering Function, as well as the Manager responsible for preparing the Company’s financial reports.

The Committee may suggest that the Chairman of the Board of Directors requests the Internal Audit Function to conduct specific audits.

In executing its activities, the Committee also has access to all areas of activity and company departments within the Company and the companies of the Group, including at central offices and peripheral structures, and has the right to obtain any information, data or copies documents deemed necessary to carry out its tasks. In any case, the Board of Directors guarantees that the Committee has adequate resources available to fulfil its tasks and exercise its powers, establishing a budget annually, within the limits of which the

21 Committee may make use of external specialist consulting from entities with recognised experience.

Committee meetings are convened by the Chairman whenever the same deems it appropriate, by notice, containing an indication of the items to be discussed on the agenda, to be sent via any means which guarantees proof of receipt, sent at least three full days before the date set for the meeting, in time to provide the members with sufficient information on the issues to be discussed, and this shall be followed by delivery of the necessary documentation, where available, to ensure the best operation of the Committee’s work. The notice is sent to the committee members, as well as the Chairperson of the Board of Statutory Auditors for information.

If a Committee member has a personal interest, or third-party interest in an item to be discussed, he/she must inform the Committee and abstain from participating in the debate and voting.

The Chairperson of the Board of Directors, the Managing Director, the General Manager, the Joint General Managers, the Director in charge of the internal audit and risk management system, the heads of the company functions of Banco BPM S.p.A. and of other Group Companies, the statutory auditors of Group companies, the members of the Supervisory Body set forth in Italian Legislative Decree 231/2001, the parties assigned the independent auditing of the accounts and other parties whose presence is deemed useful by the Committee may be invited to attend meetings.

The Chairperson of the Board of Statutory Auditors or another auditor designated by them participates at meetings of the Committee. Statutory Auditors have the right to participate in meetings of the Committee.

The Chairperson coordinates the Committee’s work.

Between January and December 2018, the Internal Audit and Risks Committee met 24 times, attendance at said meetings was 100%, and the meetings lasted on average four hours and thirty minutes. The Internal Audit and Risks Committee, through its Chairperson, always provides an in- depth report on the activities performed and the main findings that emerged in summary form to all meetings of the Board of Directors. In 2018, the Committee also assisted the Board of Directors with regard to:

 defining the guidelines and the proposal for the Risk Appetite Framework (RAF) for 2018;

 extension of the credit risk measurement models (AIRB) and market risk models (IMA);

 the Internal Capital Adequacy Assessment Process (ICAAP) and the Internal Liquidity Adequacy Assessment Process (ILAAP);

 examination of reports on activities performed issued by internal control functions during 2017, as well as the respective schedules for 2018;

 the appointment of (i) Audit and (ii) Compliance Managers, as well as their remuneration;

22  the adoption and updating of relevant Regulations and legislation as regards the new internal legislative framework relating to the organisational and functional model of Banco BPM;

 topics that regarded relations with the Supervisory Authorities by carefully controlling and monitoring the implementation of the requests made by the latter;

 the periodic reports on risk monitoring and management drawn up by the relevant corporate functions;

 the adequacy of the organisational, administrative and accounting structure of Banco BPM and of strategically important subsidiaries with specific reference to the internal audit and risk management system.

Specific minutes are drawn up by a Secretary designated by the Committee, even if not a member of the same, for each Committee meeting.

The minutes, approved by the Committee, and signed by the Chairman and by the Secretary, is sent to Committee members, to the Chairman of the Board of Directors and to the Chairman of the Board of Statutory Auditors and, where the Committee deems it appropriate, within their scope, to the Managing Director and to the Chairman of the Supervisory Body pursuant to Italian Legislative Decree 231/2001.

When the minutes of the resolutions of the Committee cannot be drawn up in time for the Board of Directors meeting in which a proposal must be formulated or an opinion granted, the Chairman of the Committee must notify, also verbally, the Board of Directors at the next meeting of the same, on the resolutions of the Committee.

Group Risk Committee

The role of the Group Risk Committee is to oversee integrated management of the company risks to which the individual Group companies and the Group as a whole are exposed to.

The main duties of the Committee pursuant to the Regulations, as well as assisting the Managing Director and the Management and Supervisory Bodies, are:

- To examine and validate, in advance, the strategies and the policies for the integrated management of Group risks, as well as the methods, the tools and the procedures adopted to measure and control said risks, ensuring compliance with the guidelines and the instructions of the Supervisory Authorities;

- To examine reports on risks as regards the process of measuring and monitoring the risk profile, continuously verifying any changes in corporate risks and the compliance with the thresholds set for assuming various types of risk;

- To express opinions relative to risk appetite, including the Risk Appetite Framework, the development of the ICAAP and ILAAP reports as well as the Recovery and Resolution plans;

23 - To ensure compliance with the guidelines and the instructions of the Supervisory Bodies, including therein the outcome of the assessment generated by the Regulator (SREP), also ascertaining the state of progress of corrective measures set in place to address areas for improvement and any shortcomings found by the Supervisory Authorities;

- To examine the IT risk mitigation measures proposed by the IT Operations SGS function regarding changes in IT risk, namely to form an opinion on those whose implementation falls within the scope of the Board of Directors;

- To examine the criteria, the models and the scenarios to be adopted to perform stress testing on risks, on an individual and collective basis;

- other activities related to identifying, measuring, assessing and mitigating risk. The Committee is comprised by: the Managing Director (who chairs it); the General Manager; the Joint General Manager with supervision over resources; the Audit Manager (without voting rights); the Compliance Manager; the Credit Manager; the Risk Manager; the Head of Administration and Financial Statements – the Manager responsible for preparing the Company’s financial reports; the Finance Manager; the Head of Planning & Control and the Internal Validation Manager.

The Managing/Director/General Manager of the individual subsidiaries (Banca Akros and Banca Aletti) are as a rule invited by the Chairperson to participate in Committee meetings. In line with regulatory provisions, during 2018 the Committee was called to meet 18 times and examined and discussed (and, when taken, made the relative resolution) issues of notable significance for the Group, including:

- Risk Appetite Framework: in the context of which were approved the RAG Guidelines, as well as discussion of aspects used to define the framework, setting thresholds and setting up processes, including the outline of internal reference regulations;

- Integrated Risk reporting: it should be noted that the risks report also includes information about activities performed relative to stress tests (both risk to capital and risk to liquidity) as well as monitoring of the ICAAP and ILAAP action plans. At the same time, benchmarking activities were performed, also taking advantage of the information found in the Public Disclosure Document (Pillar 3), aimed at providing more context with regards to the Group's risk profile with respect to the trends of its main Italian and European competitors;

- ICAAP e ILAAP: aspects relative to the approval of the respective Frameworks, "ICAAP / ILAAP packages" were dealt with, as well as activities associated with the structured risk identification process;

- Activities regarding aspects of the models adopted to measure first (in particular credit, market and operating risks) and second pillar risks (in particular interest rate risk of the banking portfolio and liquidity risk);

24 - Validation activities: the disclosures regarded numerous aspects relating to both methods and processes; in particular, they focused on the relation between changes to risk measurement models currently being used and monitoring reports;

- Second-level controls as regards loans: the outcome of the analyses conducted by the Risk Function were reported, and regarded verifying that credit trend monitoring was being conducted correctly, assessing the consistency of classifications and the adequacy of provisions, as well as the adequacy of credit collection. Activities to verify the updating schedule for real estate appraisals for assets guaranteeing the non-performing portfolio were further studied, as well as the process used to identify the “most significant transaction” in the context of the performing portfolio;

- Second-level controls as regards investment services: using sampling techniques, after the fact checks were carried out on the pricing of illiquid financial instruments, traded with customers on the secondary market, as well as defining the integrated controls framework used by the Risk Function for investment services;

- ECB and Bank of Italy inspections: disclosures were discussed relative to inspection and investigation activities on the part of the ECB and Bank of Italy. The Committee was also involved in other disclosures relative to the execution of the EU-wide Stress Test during 2018, and advance information with regards to the SSM Liquidity Stress Test planned for 2019 was provided;

- Monitoring Activities including: Most Significant Transactions (MST) and consolidation of the relative regulations, with particular reference to the definition of rules to identify and perform quarterly monitoring in compliance with the reference regulations; Related Parties, with quarterly reporting on the trend of exposures and verifying compliance with regulatory and management limits both at the Group and individual company levels;

- Recovery and Resolution Plan: the Committee analysed the work performed and was kept up to date on interactions with the Regulator and the Single Resolution Board;

- Public Disclosure Model, the Committee examined the draft Disclosure Model for the year in question, which constitutes, together with the Pillar 3 Regulations and Process Norms, the overall policy with regards to disclosures to the public. This document describes the frequency and type of disclosures to be periodically issued to the market;

- Public Disclosure (Pillar 3) - during the year, the Committee verified the contents and compliance with the publication methods for Pillar 3 documents prepared, through a formalised process which guaranteed more efficient management of qualitative/quantitative information provided by the individual contributing structures, as well as direct traceability and historicisation of data.

Other important topics were discussed, including:

- Second level reporting regarding risk data quality, including updates with regards to the BCBS 239 assessment; 25 - The Framework for the Risk Function regarding investment services;

- Investigation of risk regulations, particularly with reference to the Fair Value Policy;

- Investigation of market risks, including approval of the market risk parameters ( Pricing Models), methodological manuals relative to derivatives, securities, revision of AVA methodology, etc.;

- Investigation of modelling relative to liquidity and interest rate risks;

- Disclosure relative to leveraged financing, following the publication in May 2017 of the definitive version of "Guidance on Leveraged Transactions", which took effect in November 2017;

- Internal Transfer Rate (ITR).

Additionally, the Committee analysed with a great deal of attention the numerous disclosures made with reference to the Group's increased risk profile as a consequence of the Italian political situation, which led to an exceptional increase in the spread between the ten-year BTP/Bund.

Other Group Committees In addition to the Risk Committee, the Finance Committee and the New Products and Markets Committee operate within the Committees envisaged by the relevant internal regulations, with specific duties as part of the risk assumption, management, measurement and control processes.

The first is chaired by the General Manager and the second by the Managing Director, and they both entail the participation of the main top managers of the Group:

 Finance Committee: established with a view to providing support to the Management Bodies in analysing and optimising the risk/return profile at Group level as regards interest rate, liquidity, market and counterparty risks; it defines and implements policies regarding liquidity and financial investments, including equity investments, and hedging transactions for interest rate mismatches for Asset Liability Management (ALM);

 New Products and Markets Committee: established to examine and approve proposals for new products and services, the entry into new (or exit from) markets and distribution channels, the introduction of new counterparties or the launch of new activities, the disposal of existing products and services also through entering into or changing commercial distribution agreements.

Also note that the Committee to Coordinate the Group's Internal Audit System has, among other things, the responsibility for strengthening coordination and cooperative mechanisms between the internal audit functions. The Committee provides full and properly graduated representation of the overall risks to which the Group is exposed, supporting the adoption of consistent identification and measurement methods and of reporting models relative to these risks that support understanding and proper assessment with an integrated logic. The Committee is chaired by the Audit Manager.

26 The following paragraphs contain a description of the structure and the duties of the corporate audit functions of the Banco BPM Group.

The main corporate functions of the Parent Company Banco BPM SpA involved in risk management and control are the following:

 Audit Function;

 Risk Function;

 Compliance Function;

 Credit Function.

The Audit Function carries out internal auditing activities required under the supervisory provisions through third level controls on the regular performance of operations and developments in risks. It assesses the completeness, adequacy, functionality and reliability of the organisational structure and other components of the internal audit system, also informing the competent bodies of any ways in which the risk management process could be improved.

The Risk Function, the organisational unit that reports Banco BPM’s Managing Director, oversees - at Group level and in an integrated way - the processes of managing risk (Enterprise Risk Management), developing and measuring risk (Risk Models) and the process of validating internal risk measurement models (Internal Validation).

The Head of the Risk Function also seek to facilitate the corporate Bodies in performing their respective duties as regards the Internal Audit System, by:

- intercepting all relevant information for the quantification and management of risk promptly and in a coordinated manner;

- a more integrated ability to process, systematise and contextualise the information acquired and to make evaluations (both in terms of risk and of the value of the assets) independently from other applications;

- an (integrated) summary presentation of corporate risks and, therefore in this way, a greater understanding, by the Corporate bodies, of the main problems highlighted by the second-level internal audit system;

- the adoption of prompt and consistent corrective measures relating to the problems and the relative priorities highlighted by the second-level internal Audit Functions.

The Risk Function and the structures within it are independent from the operating functions and activities. Specifically, they are in charge of:

 consistent with corporate strategies and objectives, defining guidelines and policies on risk management, compliance and legal matters;

 coordinating the implementation of guidelines and policies on risk management, compliance and legal matters by the relevant group business units, and in other corporate departments as appropriate;

27  guaranteeing the measurement and control of group exposure to the various types of risk and the related capital absorption, verifying the implementation of guidelines and policies defined on risk management and compliance with the thresholds defined within the Group Risk Appetite Framework;

 guaranteeing the development and the continuous improvement of the models and of risk measurement metrics - for First and Second Pillar, in ordinary and stressed conditions - also through projects addressed to implementing advanced models, to aligning to standards that are introduced at international level over time, to implementing Supervisory regulations and directives as well as to developing increasing effective oversight;

 monitoring the process used to validate internally developed models used to calculate Pillar I and II capital and liquidity requirements;

 overseeing the process of verifying, through second-level controls, the proper conduct of performance monitoring on individual exposures, and checking the consistency of classifications, the consistency of provisions and the adequacy of the loan recovery process;

 ensuring that information used for risk measurement, monitoring and reporting relative to its responsibilities is done in the context of a robust data quality and aggregation framework.

The organisational structure of the Risk Function includes three structures which directly report to the Manager:

. “Enterprise Risk Management”, through:

- “Risk Strategy & Capital Adequacy”: tasked with overseeing the operating aspects of the operational implementation of the RAF, preparing analyses and the documentation needed to assess the Group’s capital adequacy and to evaluate the recovery measures to set in motion in the event of particularly adverse scenarios (Recovery Planning); it also ensures periodic and integrated disclosure of the overall risk profile of the Group. Coordination of disclosure processes (for example Third Pillar, Financial Statements) and assessment of the risks and of the consistency of “most significant transactions” (MST) with the RAF, as well as verifying that the limits as regards Related Parties and Leveraged Transactions are complied with;

- “Risk Data Quality & Aggregation”: contributes to the development and improvement of Data Quality controls needed to ensure complete and accurate capital disclosures used by the Risk Function. It performs second level controls on data used in the risk calculation and reporting processes and monitors execution of data quality activities performed by the functions responsible for the data. It is tasked with supporting the Bank in the process of defining standards in line with the Basel Committee Risk Data Aggregation and Reporting standards (BCBS 239) and provides methodological support for data governance aspects to the functions responsible for the data;

28 - “II level Controls”: it verifies, through mass analysis and the revision of individual positions sampled statistically or on the basis of a specific risk profile, that performance monitoring of credit exposures, in particular impaired loans, is being carried out correctly, by assessing the consistency of the classifications and the adequacy of provisions; it also verifies the adequacy of collection activities and the presence of updated appraisals of guarantees. It performs audits relative to Customer Risk, the results of which are inserted in the annual Investment Services report, in particular with regards to the pricing of illiquid financial instruments traded with customers on the secondary market, and the Best Execution macro process.

. Risk Models, through:

- Credit Risk: with responsibilities for the identification, measurement and control of the credit risks, collaboration for the calculation of the corresponding minimum capital requirements and achievement, management and optimisation of the Internal Rating System; development and maintenance of the methods, models and metrics for the measurement of the credit risks, with particular reference to the internal models for the calculation of the risk factors (PD, LGD, ELBE, LGD DA, EAD), as well as the credit risk according to an operational approach (credit-VaR);

- Market Risk: responsible for identifying, measuring and checking the market risks; defining the measurement methods, periodically checking the reliability, proposal and monitoring of the operating limits; contributing to the validation and review of the pricing models of the financial instruments and collaborating in the calculation of the minimum capital requirements; identifying, measuring and checking the counterparty risks; collaborating in the definition, measurement and monitoring of the risk measurement models and of the performance of customer portfolios and of assets under management;

- Operational risk: with responsibilities for the development of methods for identifying, assessing, monitoring, controlling and reporting the operational risks; determination of the individual and consolidated minimum capital requirements and of management estimates of the income statement; identification and determination of appropriate operating thresholds; support for the indication of the operational risk mitigation measures;

- Interest Rate Risk: definition and development of methods for identifying, monitoring and reporting the interest rate risks with identification and determination of appropriate operating limits; measurement and control of said risk; drafting of suitable reporting for the Company decision-making bodies and for the Companies monitored;

- Liquidity Risk: responsible for identifying, measuring and monitoring liquidity and funding risks, continuously verifying compliance between the Group's risk profile and its approved risk appetite, preparing appropriate reports for the company's decision- making bodies. It takes part in the definition and implementation of the Liquidity Contingency Plan, applying and developing the internal process to determine liquidity adequacy (ILAAP); 29 . Internal Validation, addressed to independently overseeing the internal validation processes of risk measurement and management systems, to assessing the model risk implicit in the methods used to measure risk, conducts controls aimed to validate the calculation of capital requirements and to validate pricing models.

The Compliance Function oversees, according to a risk-based approach, the management of compliance risk with regard to all provisions applicable to the Banco BPM Group, verifying - during both the start-up and functioning phases - that internal procedures are adequate to mitigate that risk.

In particular, the compliance risk management model envisages:

- the definition, development and maintenance of methodologies and instruments supporting risk management processes;

- the planning of audit activities;

- the monitoring and the analysis, from a future perspective, of the main legislative changes applicable, with specific reference to those with a significant impact on governance and on the company’s business model;

- preventive compliance activities that are mainly implemented by providing assistance and advice to the Top Management Bodies and to company structures on regulations and their application to internal processes;

- the validation of internal regulations and organisational structures;

- the performance of controls and ex-post audits and the identification of mitigation measures for the compliance risks identified;

- the preventive identification and continual assessment of compliance risk, namely potential harmful events, the relative frequency and impact, and an assessment of the effectiveness of the supervision in place;

- the measurement and assessment of residual compliance risk and the preparation of reporting for the Top Management Bodies.

The Compliance Function and the structures within it are independent from the operating functions and activities. The Parent Company's Anti-Money Laundering Function is located within the Compliance Function and reports directly to company bodies for the relevant areas. With full auditing autonomy, it monitors the risk of money-laundering and financing of terrorism, as well as notifications of suspect operations. It carries out the activities required under the regulations assigned to the Anti-Money Laundering Function and the Suspect Operation Notification Officer (SOS).

During 2018, the Compliance Manager was also assigned the role of Data Protection Officer, pursuant to European Regulation 2016/679 (GDPR), relative to personal data protection.

The Credit Function pursues the objectives of optimising credit quality and minimising global credit risk costs for the Group, through the following activities:

- coordinating activities for implementing the credit guidance and policies; 30 - defining lending rules in order to ensure standardised approaches and language within the Group, contributing to the development of the Rating System;

- proposing maximum limits for credit facilities for large customers; - expressing a mandatory, non-binding opinion on the maximum amount of credit facilities which may be granted to single or associated customers with exposures exceeding the pre-set thresholds;

- monitoring and managing the most significant anomalous positions. In addition to these functions, the operating structures within the Parent Company and in the Subsidiaries, which are in charge of first level controls, are also involved in risk control.

Risk profile and risk management and measurement systems The Board of Directors of the Parent Company Banco BPM approved the Risk Appetite Framework (hereafter, also "RAF") in the first quarter of 2018, through which the strategic supervision body defines the risk levels the Group is willing to take on in pursuing its strategic objectives. Specifically, Circular 285 requires the adoption of an RAF which:

- assigns the Body in charge of Strategic Supervision the task to define and approve the risk objectives, the tolerance thresholds (where identified) and the risk governance policies;

- envisages the adoption of an integrated approach to risk management;

- highlights the circumstances, including the outcomes of stress scenarios, in which the assumption of certain categories of risk should be avoided or contained with respect to the objectives and the limits set;

- uses appropriate quantitative and qualitative parameters to establish the elements that make up the RAF;

- indicates the procedures for operational measures to activate (escalation) if it is necessary to reduce risk levels to within the pre-set objective or limits;

- states the timing and the procedures to be followed to update the RAF (due to changes in legislation, in the reference scenario or internal context) as well as the tasks of the Bodies and of all of the corporate functions involved in process definition.

The Risk Appetite Framework of the Banco BPM Group is comprised of the following basic elements:

1. “Governance”, which defines the roles and responsibilities of the parties involved and the information flows between the same;

2. The “system of metrics”, which summarise risk exposure;

3. The “system of thresholds”, through which the risk appetite is defined;

4. The “escalation process”, which is activated with different intensities and parties when different thresholds are surpassed; 31 5. The methodological document “Risk Appetite Statement (RAS)”, which contains an analytical description of the calculation procedures for the metrics and definition of the relative thresholds;

6. The “tools and the procedures”, which support the representation and the operating management of the RAF, including what are known as "Most Significant Transactions" (MST).

The RAF is a tool that makes it possible to establish, formalise, communicate, approve and monitor the risk objectives that the Group and the individual relevant Legal Entities intend to take on, in a unitary manner. To that end, thresholds and risk sectors are identified which make it possible to identify beforehand the levels and types of risk the Group intends to take on, further specifying the roles and responsibilities of the bodies and company functions involved in the management of these risks. The Group must guarantee that the operating version of the RAF is used and interiorised and represented a guideline when setting processes in place, such as, by way of example, the Strategic Plan and the Budget, as well as the Internal Capital Adequacy Assessment Process (ICAAP) and Internal Liquidity Adequacy Assessment Process (ILAAP). The framework is also used as an operating tool in the context of the Recovery Plan and when defining Remuneration Policies.

The general principles that guide the Group’s risk assumption process can be summarised as follows:

 activities are performed taking into account the risks assumed and the controls set in place to mitigate the same from a short and medium-long term perspective;

 particular attention is paid to capital and liquidity adequacy and to the credit quality of the portfolio, also in the light of the introduction of new legislation and of regulatory restrictions imposed by the Supervisory Body.

The RAF indicators make use of the Risk Identification Process, taking into account regulatory indications regarding Risk Governance. All significant risks identified during the process are considered when defining the Risk Appetite Framework, and specific indicators are identified for monitoring purposes. Specifically, the RAF for the Group has identified various indicators, classified based on the main types of risk: Pillar I and Pillar II Capital Adequacy, Liquidity Adequacy, Credit Quality, Profitability, Operations/Actions.

The indicators that summarise the Group’s risk profile in these areas have been divided into 2 levels, differentiating between strategic indicators, which enable the Board of Directors to guide the Group’s strategic decisions, and operational indicators, in order to integrate and anticipate the dynamics - where possible - of the strategic indicators. Specifically:

 the Strategic RAF is a set of metrics and thresholds that enable the Group’s risk strategy to be defined and monitored; it includes a limited and exhaustive number of indicators, which express the risk appetite approved by the Board of Directors and represent the summary performance of the overall risk profile.

 The Management RAF is a set of metrics that makes it possible to integrate and detail the strategic indicators and anticipate developments in the risk profile. These metrics make it possible to identify specific aspects of the main company processes 32 and as a rule can be monitored more frequently to serve as an early warning of possible critical situations.

The system of thresholds for the strategic indicators envisages the definition of the following limits:

 Risk Target (medium/long-term objective) generally the risk objective defined in the Business Plan at the Group level. Indicates the level of risk (overall and by type) that the Group wishes to be exposed to in order to achieve its strategic objectives.

 Risk Trigger: the threshold, differentiated by indicator, which when exceeded activates the various escalation processes established in the Framework. The Risk Trigger is also determined using stress tests. In line with the Trigger values, a system of limits used for operating purposes is also defined "Risk Limits").

 Risk Tolerance: this is the maximum permitted deviation from the Risk Appetite; the tolerance threshold is set in such a way so as to ensure that the Group has sufficient margins to operate, even in conditions of stress, within the maximum risk that may be assumed.

 Risk Capacity: this is the maximum level of risk that the Group is able to assume without infringing regulatory requirements or other restrictions imposed by the shareholders or by the Supervisory Authority.

On the other hand, for Management Indicators, only the Risk Threshold is identified. When risk limits are exceeded, specific escalation processes are promptly activated.

The Risk Function, in collaboration with Planning and other relevant Functions, develops the RAF, by providing support to the Body in charge of management, from a legislative and operating perspective, consistent with strategy, business plans and capital allocation in ordinary conditions and in situations of stress. The RAF is updated at least once a year, also in the event of changes in the internal and external conditions in which the Group operates.

From an operating perspective, risk prevention activities are also found in the process to manage Most Significant Transactions (relating to credit, finance, credit assignment and other transactions) and leverage operations, which primarily involve the Risk Function, which must express a prior and non-binding opinion on all transactions that meet the identification criteria established and regulated internally.

Type of Risk Profile - Risk Risk RAF 2018 – main indicators Risk Target Risk Trigger indicator Dec 2018 Tolerance Capacity CET 1 ratio (phase in) Strategic 12.1% 12.9% 10.0% 8.9% 7.0% Tier 1 ratio (phase in) Strategic 12.3% 12.9% 11.0% 10.4% 8.5% Total Capital ratio (phase in) Strategic 14.7% 16.0% 13.0% 12.4% 10.5% Leverage ratio (phase in) Strategic 4.6% 5.7% 4.0% 3.5% 3.0% Liquidity Coverage ratio (LCR) Strategic 154.0% - 115.0% 105.0% 100.0% Net Stable Funding ratio (NSFR) Strategic 107.0% 105.0% 102.0% 101.0% 100.0% Gross NPE / Total Gross Loans Strategic 10.8% 17.9% 19.0% 22.5% 24.0% Total risk exposure (economic capital) Managerial 7,564 - 9,480 - -

33 The Banco BPM Group also defines the Risk Appetite Framework not just at Group level, but also for all significant Legal Entities, by means of cascading the risk appetite to individual company level, taking the respective core businesses into account, also with a view to guaranteeing that limits at consolidated level will be complied with.

Reporting and Monitoring Activities The risk monitoring and control activities performed by the Risk Function seek to ensure, at Group and individual company level, the harmonised supervision of the risks within its scope, by guaranteeing appropriate and timely information to the Corporate Bodies and to the Organisational Units involved in managing said risks, ensuring the development and the continuous improvement of the methods and the models adopted for their measurement.

To that end, the Parent Company prepares reports for the company bodies on a monthly basis, in line with the Group's internal policies. As regards integrated risk reporting, the Risk Function analyses the main risks to which the Group is exposed and periodically assesses the risk profile of the RAF indicators, comparing them with the thresholds established in the framework, providing historic and detailed analyses to explain the trends, the focus areas, and the areas for improvement.

Benchmarking analysis of the main Italian banks allows the company bodies and top management to have more integrated view of the Group's risks. Activities performed within the context of the reporting system ensure that appropriate and timely information reaches the company bodies, senior management, internal audit functions and the organisational units involved in risk management.

Pillar I and Pillar II Capital Adequacy To provide its management team and the Supervisory Authority with a complete and informed disclosure, which confirms the adequacy of its own funds, the first defence against the risks assumed, the Banco BPM Group assesses its capital situation from a current and future perspective, both as regards Pillar I and Pillar II, based on Basel 3 rules (which are applied through CRR/CRD IV) and the specific guidelines that the banks receive from the Supervisory Authority.

As regards Pillar I, the Group’s capital adequacy entails continuously monitoring and managing the capital ratios, calculated on the basis of the information provided by the Accounting and Financial Statements Function through the application of the rules established by Supervisory Regulations, in order to verify compliance with regulatory limits and to ensure that the minimum capitalisation levels required by Supervisory Regulations are maintained. Said ratios are also estimated at the time of the Budget or Strategic Plan and their consistency with the thresholds set within the Risk Appetite Framework and the estimates made in the Capital Plan is verified.

As regards Pillar II, the Risk Function is tasked with coordinating the internal process to determine the Group’s capital adequacy, in accordance with regulatory provisions, and with making the current and forward-looking estimates summarised in the annual ICAAP (Internal Capital Adequacy Assessment Process) report. 34 The ICAAP, regulated internally by specific regulations and circulars, enables the Group’s exposure to be assessed as regards Pillar I risks (credit, counterparty, market and operational) as well as that to other relevant risks identified internally or on the basis of the regulatory provisions through the Risk Identification process.

Assessment of capital adequacy, within ICAAP, occurs through verifying compliance with Pillar I and II capital requirements (capital reserves calculated as the difference between Available Financial Resources [AFR] and capital requirements, calculated through advanced methodologies developed internally and validated by the competent company function), making use of the Risk Appetite Framework and qualitative elements.

The result of the ICAAP, performed on a multi-year basis, takes into consideration simulations performed both with an eye to regulatory requirements and through the application of internal management methodologies. Simulations are performed under normal business conditions and also take into account results deriving from the application of stress tests.

Regulatory and operational liquidity adequacy The Banco BPM Group manages the adequacy of its liquidity and funding profile both from a current and future perspective, as regards Pillar I and Pillar II, based on Basel 3 rules and the guidelines of the Supervisory Authority.

The Group’s regulatory liquidity adequacy is continuously monitored through two ratios: the Liquidity Coverage Ratio (LCR), which promotes the short-term resilience of the liquidity risk profile of the bank by ensuring that it has sufficient high-quality liquid resources to overcome a situation of acute stress lasting one month; the Net Stable Funding Ratio (NSFR), which seeks to encourage longer-term resilience by providing the bank with greater incentive to fund its activities by utilising more stable sources of funding on a structural basis. This structural ratio has a time horizon of one year and was developed to guarantee that assets and liabilities have a sustainable maturity structure. These ratios are integrated into Pillar II by metrics developed internally, complementary to the regulatory liquidity ratios and stress analyses.

The Group has also provided itself with a strategy for the Internal Liquidity Adequacy Assessment Process (ILAAP). In fact, the ILAAP is the internal process the Banco BPM Group uses to management and monitor liquidity risk at the Group level and to assess the adequacy of its short-term and medium/long-term liquidity. The ILAAP also includes an annual internal self-assessment of its overall liquidity risk management framework, aimed at continuous improvement of the same.

Categories of risks monitored and managed by the Banco BPM Group The risk identification process is the starting point for all of the Group's strategic processes. This process is a structured and dynamic path that is performed annually at the Group level by the Risk Function, involving the Bank's top management and the main companies in the Group, making it possible to identify the main risk factors and emerging risks to which it is or could be exposed, ensuring the process is effectively performed and disseminated within

35 the Group. Process output is in the form of a risk map, a list of the risks judged significant for the Banco BPM Group.

The risk map represents the basis for defining the RAF indicators and the risks contained in it must be considered in the ICAAP, both from a quantification perspective, where possible, and in terms of a description and assessment of the measures set in place to prevent and mitigate risk. The Parent Company guarantees the measurement, monitoring and management of the capital requirements for each type of risk and guarantees the supervision and the quantification of the capital resources available to the Group to cover its risk exposure with a view to complying with the regulatory obligations of Pillar I and Pillar II of Basel 2.

More specifically, the centralised management of Group capital adequacy, which entails a comparison between the amount of available capital resources and the capital requirements resulting from the risks to which the group is exposed, from a current and future perspective, in normal and stressed conditions, is performed by implementing the ICAAP process, as required by the “Supervisory Provisions for banks” (Circular 285/2013, as updated).

The following paragraphs illustrate the main characteristics of the risks considered significant by the Group following the implementation of the Risk Identification process in the last quarter of 2018.

Credit and counterparty risk

Definition and objectives This is the risk that a debtor of the Group (including counterparties in financial transactions involving over the counter derivatives - which in this case more specifically involves counterparty risk, for which please refer to the specific section on "Counterparty risk") does not comply with their obligations, entirely or partially, or that their credit standing deteriorates.

Concentration risk (dealt with below) is closely connected to credit risk, and derives from exposure to counterparties, groups of associated counterparties, or counterparties in the same economic sector or which carry out the same business, or are located in the same geographic area.

As to guarantees, the residual risk (which is illustrated hereinafter) is managed associated with the possibility that generally accepted techniques to mitigate credit risk used by banks may be less effective than expected.

Internal regulations have been developed to handle this risk, which govern the processes of acquisition, finalization and management of guarantees in a standardised way throughout the entire Group.

The assessment of possible losses that could be incurred by the Group with regard to a single credit exposure or the total loan book depends upon many factors, among which the general economic conditions or those of specific production sectors, the change in the rating of single counterparties, structural and technological changes within borrowing 36 companies, a deterioration in the competitive position of counterparties, the possible mismanagement of companies or borrowing counterparties, the growing indebtedness of households, structural macroeconomic factors and other external factors, such as legal and regulatory requirements applicable to this matter.

The Banco BPM Group pursues lending policy objectives aiming at:

- supporting the growth of the business activities operating in its market territories, with a strong customer relationship focus on small and medium sized companies and on households;

- diversifying its portfolio, limiting loan concentration on single counterparties/groups, on single sectors of economic activity or geographical areas;

- applying a homogeneous credit management model, based on internal IT and regulatory rules, methodologies, processes and procedures that have been standardised for all Group banks.

The loan book monitoring, carried out by the Parent Company’s Credit Function, is focused on the performance analysis of risk profile of economic sectors, geographical areas, customer segments and types of granted credit lines, as well as on other analysed spheres of action, allowing the definition of possible corrective actions at central level. Reports produced are submitted periodically for the attention of the Parent Company’s collective bodies.

Group lending policies The organisational model of the Group with respect to its lending activity complies with the following principles:

. the Parent Company guarantees a consistent management, planning, coordination and control of the credit process and of the associated risks for the Group banks and companies, by defining policies, procedures and processes, roles and responsibilities, assessment criteria, adequate organisational, operational, IT and training tools and making sure that they are properly adopted;

. the banks and operating companies of the Group autonomously, i.e. within the set limits established by the Parent Company, assess and approve the loans they grant directly, and retain the ownership of the relationships and of the related profit and risk components.

With the aim of optimising credit quality and minimising global credit risk costs for the Group and the single companies, under the organisational model, the Parent Company’s Credit Function is in charge of guiding, coordinating and controlling credit policies.

To actually implement the Group credit model, the Parent Company:

. defines Group credit policies in keeping with the strategies, risk appetite and economic objectives specified by the governance bodies, with the aim of guiding the overall size, risk profile and diversification of the loan book;

. determines the principles and rules for assigning decision-making responsibilities and 37 credit authorities, taking the most significant credit decisions;

. prepares line controls and risk management controls, carrying out monitoring on overall loan book trends;

. defines “country risk” limits.

With respect to the procedures to assess creditworthiness, and the approval and management of positions, each lending company adopts its own structure of decision- making bodies and defines the delegated powers to authorise loans, in keeping with the guidelines issued by the Parent Company.

Within the context of the Group, guidelines are established relative to the assumption of credit risk, in order to avoid excessive concentration, limit potential losses and guarantee credit quality. In particular, when credit is granted, the Parent Company serves to guide, govern and support the Group through:

. lending rules, regulating credit risk-taking modalities with respect to customers in the granting phase as well as in the lending formalisation phase;

. the lending ceiling, that is, the global limit for loans that Group companies can grant to larger risk groups;

. the formulation of “prior approvals” on the total amount of loans that can be granted to a single customer or a group of customers borrowing from the Group.

A careful assessment of creditworthiness is carried out also for institutional counterparties (banks and investment banks), in particular with regard to financial transactions (trading of derivatives and money market instruments, lending, investments in bonds).

The key principles underlying the management of risk originating from these counterparties, as indicated above, are as follows:

. centralisation of the lending process in the Parent Company;

. internal system for the assignment and periodic review of ratings (in addition to those issued by international agencies);

. systems that measure and control credit exposure and compliance with limits on a daily basis;

. minimisation of the risk generated by OTC derivative contracts by making extensive use of risk mitigation mechanisms (Credit Support Annex agreements with all main counterparties).

Management and control processes and instruments The Banco BPM Group makes use of a detailed combination of tools to monitor trends in the quality of the loan portfolio, which also includes internal ratings. These latter are calculated using differentiated models, estimated specifically by customer segment (large corporate, mid corporate plus, mid corporate, small business and private).

The rating plays a role in deciding which are the competent bodies to approve loans and contributes to guide the decisions of loan managers when classifying positions based on 38 their performance.

Rating plays a central role in the processes of disbursement, monitoring and performance management. When specific cases occur, the Rating and Performance Desk organisational unit must examine the positions and decide whether to change the rating (“override” process).

As to the internal lending limits of the Banco BPM Group, in addition to the compliance with risk concentration limits defined by supervisory regulations, whenever a pre-set loan threshold is exceeded in case of major customers, the Group Credit Function must approve maximum plafond or the Parent Company’s competent boards must express their decision thereon.

The Parent Company also decides the country classification and the Group-wise maximum exposure level for each country.

The credit risk estimate models are developed under the responsibility of the Risk Models unit. Amongst these, in particular, the following rating models were authorised in 2012, for the use for prudential supervisory purposes until 31-12-2017 (for further details relating to rating models and their scope of application for reporting purposes, please refer to the “Capital Adequacy” and “Credit risk - IRB” sections below):

 five rating models, used to estimate the Probability of Default (PD), respectively of the segmented Business counterparties (“first acceptance” and monitoring): Large Corporate, Mid Corporate Plus, Mid Corporate, Small Business and Private (“rating model” segmentation);

 two Loss Given Default (LGD) models, for estimating the loss rate in the event of default of the Corporate and Private Individual counterparties respectively for the different statuses (performing and non-performing).

Following the acceptance of the model change application made by the former Banco Popolare in May 2015, the ECB authorised the Group to make the model changes requested incorporating a series of temporary prudential measures into the calculation of non-performing RWAs, of non-performing expected losses and on the retail EAD. These measures would have expired after authorisation to use the new A-IRB models for retail EAD, LGD defaulted assets and ELBE. Starting from the reporting of 31-03-2017, and for the whole of 2017, the following prudential measures (add-ons) were therefore made operational:

 application of a credit conversion factor of 100% for IRB Retail exposures:

 calculation of non-performing IRB RWA through application of a regulatory formula

 obligation of a floor for non-performing expected loss corresponding to 45% of gross exposures.

On 16 February 2018 Banco BPM S.p.A. received authorisation to use internal models to calculate capital requirements for the post-merger Banco BPM portfolio. This authorisation includes, in addition to the updated PD model, a new EAD retail model, and the ELBE and LGD Defaulted Asset model. Following the authorisation, Banco BPM must used the ADDs on

39 (LGD parameter multipliers), until all the findings outlined by ECB in the authorisation letter have been resolved.

These models have been used to calculate capital requirements starting from the reports issued on 31 March 2018.

The Risk Models organisational unit has also developed additional models to estimate risk factors (PD, LGD) used solely for managerial purposes.

The credit risk parameters (PD, LGD and EAD), determined using internal models, are used in management reports. Credit risk monitoring at the portfolio level is done through the use of a statistical risk estimate model VaR, falling in the category of "default models", applied on a monthly basis of the credit exposures held by the banks in the Group, limited to loans to ordinary resident performing customers within the AIRB scope of the Group.

The model used makes it possible to estimate economic capital against credit risk, taking into account portfolio concentration, and with a hypothesis of joint non-compliance by counterparties, under a pre-established situation of significant macroeconomic variables. The confidence interval used is 99.9% and the reference time horizon is one year.

In particular, the operating capital absorbed by counterparties is determined along a “Monte Carlo” approach that simulates a sufficiently high number of scenarios to provide a good empirical approximation of the theoretical distribution of loan book losses in an adverse context.

For exposures other than those relative to performing ordinary resident customers in scope of AIRB, control over risks is achieved by means of the use of supervisory regulatory metrics (Standard/Irb). Finally, the portfolio model is periodically stress tested to verify how sensitive the credit risk of the Group portfolio is to extreme changes (albeit plausible) of one (sensitivity analysis) or more (scenario analysis - historic and hypothetical) economic and financial factors.

With regard to the measurement of Counterparty Risk specifically, please refer to the qualitative disclosure in the section on that topic.

Main management and control structures The Parent Company's Credit Function defines credit rules which must be followed by the companies in the Group and formulates, in line with the economic strategies and objectives approved by the Parent Company Board of Directors, the relative credit policies with the aim of guiding the overall size, classification and diversification of the Group's loans portfolio, with the goal of minimising the cost of credit.

The Rating Desk and Performance structure implements overall monitoring of performance management, identifying requirements and actions to be implemented to support the same. For "large customers" of the Group, the Function suggests reliability ceilings to be submitted for approval to the relevant decision-making bodies and expresses an obligatory but non-binding "preventive opinion" on the maximum amount of loans which can be granted to customers with exposures exceeding pre-established thresholds.

Within the Credit Function, the Rating Desk is tasked with examining and assessing possible 40 changes to ratings on positions that could be contradictory and refers to the Risk Function for an analysis and possible measures on the rating models.

Risk Models involves the Credit Risk Function for the management and control of credit risk, through the following areas:

. Credit Risk Models: have the mission to develop and maintain the methods, models and metrics for the measurement of credit risks, with particular reference to the internal models for the calculation (i) of the risk factors (PD, LGD, EAD), as well as (ii) the credit risk according to a managerial approach (credit-VaR): these models are intended (i) to calculate the minimum capital requirements on an individual and consolidated basis in compliance with that authorised, from time to time, by the Supervisory Body as well as to calculate the internal capital with a view to Pillar II of Basel II;

. Credit Risk Measurement and Control: has the task of measuring, monitoring and controlling absorption of capital against credit risk, from a regulatory (Pillar I of Basel III) and managerial standpoint (Pillar II of Basel III), also with reference to the exposure limits defined from time to time. It also works together with the competent company offices for the determination of the weighted assets for the risk for the entire loan book as well as in order to estimate the full fair value of performing mortgages and loans that incorporates PD and LGD risk measures.

Coverage and mitigation policies The Banco BPM Group always keeps a watchful eye on the acquisition of loan collaterals and securities, i.e. the use of tools and techniques that mitigate credit risk.

When deemed necessary, the typical bank guarantees are acquired, namely mortgages on properties, collaterals on securities in addition to personal guarantees issued by the guarantors.

In general, the decision on the acquisition of a guarantee is based on the customer’s creditworthiness and on the characteristics of the transaction.

The system for the recording of collateral property for loan transactions, which also allows for periodically revaluing the property, has been consolidated.

The value of the financial collateral is constantly and automatically monitored, so as to compare the present value of the collateral to the initial one, and to allow the manager to act in time in case the collateral suffers from a significant impairment loss.

With regard to derivative transactions with market counterparties, we favour entities with which we have entered into agreements requiring the provision of collateral, especially ISDA - Credit Support Annex, so as to obtain a significant credit risk mitigation.

For more information on the management of collateral guarantees, see the “Risk Mitigation Techniques” and “Counterparty Risk” sections.

41 Market risk

Definition Market risk consists in the possibility of generating fewer revenues than expected, impairment in balance sheet items or capital losses on financial positions held, due to sharp adverse changes in market conditions and, specifically, in interest rates, share prices, exchange rates and the associated volatilities and correlations (general risk), or due to events that may impair the issuer’s repayment capacity (specific risk).

Risk management strategies and processes With regard to trading books, market risks stemming from the commercial activities performed by Group banks are systematically transferred over to the subsidiary Banca Akros. The commercial banks hold only residual positions as compared to the above books, for specific needs and purposes of individual banks or those directly linked to commercial activity.

The organisational model adopted by the Banco BPM Group for trading books is based on the centralisation:

. of Treasury positions in the Parent Company’s Finance function in charge of coordinating the management of short term liquidity and interest rate risk and exchange risk positions within the Group, and of managing the Proprietary portfolio to optimise its overall risk/return profile, by diversifying risks across different asset classes of financial instruments;

. in the subsidiary Banca Akros of the risk positions and the operating flows associated with securities, currency, OTC derivative trading and other financial assets.

Structures and organisations involved in risk management Control of financial risk management, with the aim of identifying the type of risks, defining and implementing the risk measurement methods and controlling limits at strategic level is centralised within the Risk Function for the main Group companies.

For the identification, measurement, management and operating control of the risk positions of the Banks of the Group, the Group’s Finance function and Banca Akros make use of position-keeping and risk control systems that provides a constant control over exposure levels and over the accurate verification of compliance with the operating limits defined by the Corporate Bodies.

In case of financial instruments with very complex and innovative structures, these models are complemented by pricing and sensitivity measurement models developed internally, that consider product characteristics and the dynamics of the underlying market variables. For each new pricing model, or any changes in models already in place, validation tests are carried out by the Risk Function.

This consists in the verification and validation of the pricing model being analysed, so it can be used in Front Office systems and to control and measure risks. The quality of a model is subsequently verified on a continuous basis, through appropriate revision of models. 42 The sale of each new product and its inclusion on the product catalogue are systematically preceded by an in-depth analysis of the measures required to ensure correct product management in terms of accounting, laws/regulations, settlement, pricing and risk management. These activities are coordinated by a specific Product Innovation Committee, composed of the managers of the main structures involved.

The Committee assesses and analyses observations made by individual operating and governing structures and, if necessary, deals with issues identified. It approves proposals for new products, possibly formulating its comments and/or operating instructions by drawing up a specific document, accounting to a predefined template, which becomes the “product information sheet” setting forth all the features of the new products and the certification of the effective examination and assessment of related risks.

Measurement method Generic risk on the trading book is monitored on a daily basis using deterministic indicators, such as risk exposure, sensitivity, and probabilistic indicators as well as Value at Risk (VaR).

In particular, these indicators are considered the most appropriate instruments to ensure an effective and precise measurement and control of market risks generated by exposures to complex derivatives, also from a regulatory standpoint.

Value at Risk (VaR) is a synthetic measurement of risk, expressing the maximum potential loss caused by market changes under normal conditions. The methods used to calculate VaR are part of the class of historic simulation VaR models. Historical simulation is a method used to construct the distribution of probability for a risk factor, based on past changes in the same. No hypotheses are adopted regarding the type of distribution for the fact, but a (discrete) distribution is generated starting from the current value of the factor and hypothesising changes (generally logarithmic) identical to those seen in the historical series. Another significant characteristics of the model adopted is "full joint evaluation" of transactions. Each transaction is repriced with the market parameters obtained through application of the historical scenarios for each of the past days. These parameters are jointly changed, in this way capturing the effects of interactions between them when measuring financial instruments.

In order to gauge the risk deriving from the credit component implicit in bond positions, credit derivatives and bond futures, the VAR method based on historic simulation implemented also includes the credit spread risk factor.

The risk estimate is made with a confidence level of 99% and a time horizon of one day. The observation period is 250 days. Correlations used are those implicit in the historical scenarios applied to estimate the empirical distribution of values in the trading book. Risk is defined as the maximum between those calculated with equally weighted scenarios and those calculated giving greater weight to more recent scenarios, through the use of a lambda decay factor of 0.99.

In order to verify overall capital adequacy, the Risk Function also takes a monthly measurement of market risk with a confidence level of 99.90% and a time horizon of 10 business days. 43 The reference aggregate for calculating VaR is the trading book. The model currently in use entirely covers generic and exchange rate risks and specific risk, both for debt securities and equity securities. The risk factors considered are interest rate, stock market, exchange rate and credit spread. Correlation and dividend risk are also considered.

To estimate the component of issuer risk implicit in positions in bonds in the banking book the VaR method relating only to the credit spread risk component, associated with Incremental Default Risk, is used at management level and for the purpose of assessing capital adequacy with a view to Pillar II. This method, based on a portfolio approach with a multi-factor threshold, estimates the maximum potential loss deriving from the joint default of several issuers in the portfolio.

VaR reports are prepared, through which monitoring is ensured at Group level, at single bank level, by organisational unit, and by trading book. Said reports are sent to the Bank Head Office, the Finance Function and to Internal Audit.

As to scenario analyses (“stress testing”), simulations are implemented by applying predefined shocks to the main risk factors, in order to assess the current and prospective level of capital adequacy as required by the Basel II Pillar II regulations. The stress testing calculation models were reviewed and optimised, envisaging historic, scenario and discretionary tests.

The VaR method described above is used to measure managerial risks. As from 30.6.2012, the Group obtained validation of the internal model for the purpose of calculating the capital requirement, for the generic and specific risk of the equity instrument, the generic risk of debt securities, the options and UCITS risk. At present, this methodology is applied to Banco BPM and Banca Akros. For each Group company that holds a trading book specific maximum daily VaR and capital absorption limits are defined, determined according to the metrics illustrated above.

Compliance with these limits is generally required of the Managing Directors of each company and, on a top-down basis, of the specialist departments, which periodically report to their respective Board of Directors, highlighting any overruns and the actions implemented to restore normal conditions.

The Parent Company’s Risk Function is in charge of monitoring compliance with these limits, which is carried out on a daily basis, promptly reporting any overruns.

Moreover, the Risk Function notifies the companies involved and the parties in charge of risk management when 90% of the risk limits (warning level) has been reached, regarding the consequent assessments and possible corrective measures.

Development of market risk The development of market risk assumed by the Group, measured using internal operating metrics, is summarised by the following quantitative information, which is also included in Part E of the Notes to the Consolidated Financial Statements 2018.

44 The Value at Risk (VaR) measurement considers the interest rate risk, equity risk, foreign exchange risk and credit spread risk, as well as the benefit of correlation between the risks. Correlation and dividend risk are also considered.

The performance graph and the VaR figures (confidence level 99%, holding period 1 day) are shown below for 2018, referring to the trading book for supervisory purposes of the Banco BPM Group.

Regulatory trading book 28-Dec 2018

(in millions of euro) 2018 AVERAGE MAXIMUM MINIMUM

Interest rate risk 0.846 1.028 3.637 0.043

Foreign exchange risk 0.209 0.197 1.064 0.080

Equity risk 1.671 1.162 2.351 0.399

Dividends and correlations 0.620 0.200 0.645 0.023

Total uncorrelated 3.346

Diversification effect -1.432

Total Generic Risk 1.914 1.540 3.245 0.954

Specific Risk Debt Securities 4.264 4.175 11.935 1.165

Combined Risk 4.986 4.551 12.650 1.562

As can be seen, the relevant risk component is that relative to the specific risk on debt securities, due to the presence of Italian financial and government securities. Changes in these securities account for trends in the Group's overall risks. More specifically, in the second half of the year, the portfolio indicated a greater level of risk, to be attributed both to exposures and to the volatility of the Italian government securities market.

Further to the validation of the internal model for the determination of the capital requirement on market risks, back testing is carried out on a daily basis with the aim of checking the quality of the VaR model adopted. 45 With reference to the banking book, the Group also assesses the exposure to default and migration risk of the rating classes of the debt securities classified as HTC and HTCS using a method which involves calculating the VaR spread to take into consideration the Migration component and Incremental Default Risk (IDR) to capture the Default component, with a view to complying with the instructions set forth in the European Fundamental Review Directive of March 2014.

The most important factor that impacted risk in 2018 was the trend in the volatility of the credit spread, which had repercussions on the specific debt securities risk component,in particular government issued.

Operational risk

Definition Operational risk is the risk of suffering losses caused by inadequacy or failure attributable to procedures, human resources and internal systems, or caused by external events.

This definition does not include strategic or reputational risk, but does include legal risk, understood as the risk of infringing laws and other regulations, of failing to comply with contractual and non-contractual liabilities, as well as other disputes that may arise with counterparties in the course of business activities.

The main sources of operational risk are: the low reliability of operational processes - in terms of effectiveness/efficiency - internal and external frauds, operational mistakes, the qualitative level of physical and logical security, inadequate IT structure compared to the size of operations, the growing recourse to automation, the outsourcing of corporate functions when not adequately structured and monitored, the excessive concentration of the number of suppliers, changes in strategies, incorrect personnel management and training policies and finally social and environmental impacts.

Risk management model and organisational structure Also in compliance with the relevant regulations, the Banco BPM Group adopted an operational risk management model that illustrates the management methods and the people involved in risk identification, measurement, monitoring, mitigation and reporting. In particular, the model refers to centralised oversight functions (governance and control functions) and decentralised oversight functions (coordinators and ORM contacts, which are specifically involved in the key processes of collecting operating loss data, continuously assessing the operating scenario and forecasting exposure to risk).

This model is governed by a specific Group Regulation approved by the Corporate Bodies.

To identify and measure operational risks, the Banco BPM Group has defined an internal methodology based on quantitative and qualitative analysis according to VaR logic.

The quantitative assessment is based on internal loss data, gathered through a loss collection process. This data is combined with external loss data pertaining to the Italian banking scenario (inbound flows of the DIPO consortium, set up by the major Italian Banking Groups within the ABI - Italian Banking Association), and on data deriving from the risk self- 46 assessment, a structured process involving the heads of the various organisational structures. The purpose of this component is to complement the available quantitative data, specifically in the cases where no historical loss data exist that may indicate the risk level associated with specific events (mainly with reference to rare, high impact events) or where certain corporate processes or operations are being revised in such a way as to change the level of exposure, generally assigning a forward-looking outlook to the overall assessments. The qualitative findings of the continuous monitoring and assessment of the internal and external operating scenarios are also used in this process.

Reporting system The Banco BPM Group has a reporting process which envisages:

. a management information system, quarterly analysing and assessing all significant issues concerning operational risk (in particular, material losses and the associated recoveries, based on historical or income statement data, the overall assessment of the risk profile, capital absorption, the outcome of risk self assessment processes and the monitoring and assessment of the operating environment and the risk management and mitigation policies implemented and/or planned);

. an operational reporting system, which is also quarterly, understood as a tool for the operating structures that take part in loss collection processes, useful for adequate risk assessment and management in the related specific areas.

Project for adoption of the advanced models As regards operational risk, the new Banco BPM Group has been authorised by the ECB to use the following regulatory approaches:

a) advanced approach (AMA) for the former Banco Popolare segments already validated for the use of these approaches (former Banco Popolare segments of the Parent Company, Banca Aletti including the private segments transferred to Banca Akros and from the former BPM SpA), SGS BP and BP Property Management

b) standardised approach (TSA) for the former BPM segments already validated for the use of these approaches (former Parent Company BPM Scarl and former BPM SpA segments transferred to the new parent company, Banca Akros including the Corporate and Investment Banking segments transferred to Banca Aletti), ProFamily

c) basic indicator approach (BIA) for the Group’s other minor companies

The Group pursues an objective to continuously develop the risk management framework in accordance with the objectives of the Strategic Plan, best practice in the industry and regulatory changes. In 2018, the following activities are worth a specific mention:

. Execution of activities to extend advanced approaches, for managerial and Pillar II purposes, in relation to former BPM SpA segments, useful for the preparation of an application package to be sent to the regulatory authority to request validation;

. constant rationalisation and continuing streamlining of the processes for the collection of internal loss data of the Commercial Network and the Central Headquarters, also via 47 adaptation of the IT infrastructure, as well as relying on the training/informational support provided by the ORM oversight bodies (central and local) to the staff responsible for surveying operating losses;

. constant enhancement and development of active risk management processes (monitoring, reporting and mitigation);

. definition and implementation of specific operational risk indicators within the RAF (Risk Appetite Framework) system adopted by the Group;

. continuous strengthening of the IT architecture, which put into practice the integration of all operating loss data archiving and processing functions, with application tools that enable the structures responsible for risk management to actually carry out use tests.

Concentration risk Concentration risk derives from credit exposures to counterparties, groups of counterparties that are connected to one another or belong to the same economic sector or carry out the same business or belong to the same geographical area.

Concentration Risk is monitored and managed at centralised Group level, by the Credit Function, which covers the role of guiding the lending activities and credit policies for the Group banks and companies. Specifically, it formulates lending policy strategies, regarding the composition of the Group loan book, also in terms of maximum exposure for each significant aspect, such as geographical area, industry, counterparty type, etc.

For large customers, the Credit Function specifically assesses the reliability of the counterparties and monitors the credit lines granted. It also analyses the overall and organic structure of the loan book and its composition/diversification. Finally, it periodically produces reports highlighting exposures relative to main customers.

Concentration risk is quantified by the Risk Function, specifically as part of the models used to estimate credit risk on performing books of resident counterparties.

Interest rate risk on the banking book The interest rate risk incurred by the Banco BPM Group relating to its banking book mainly derives from the exercise of its core business as an intermediary involved in transforming maturities (see the “Interest rate risk on positions in the banking book” section, which should be referred to for more details on the nature of the risk, the management strategies and the measurement methods used by the Group).

An organisational model has been adopted by the Group for risk management and control which involves the centralisation of the activities in specific structures specially delegated by the subsidiaries. In particular:

. interest rate risk management is delegated to a specific structure of the Parent Company’s Finance function;

. risk measurement and control is assigned to the Parent Company’s Risk Models function.

At Group level, a specific maximum limit is defined, applied to end-of-month VaR reporting 48 (“probabilistic” indicator with a holding period of 12 months and a confidence interval of 99.9%).

Two “deterministic” limits are also envisaged, also at Group level; these indicators are based on the measurement of the impact of an instantaneous and parallel market interest rate shock - shock which varies based on the interest rate level (currently +/- 0.40%), - on the expected interest margin at 1 year of the entity monitored, based on the capital situation at the time of recording, and of an instantaneous and parallel shock of +/- 2.00%, applying the floor from the EBA guidelines, of the rates applied to the economic value of the banking book in relation to own funds (supervisory capital).

The bodies of the Parent Company are required to comply with these limits. They periodically report to the Board of Directors, highlighting any overruns and the consequent actions implemented to restore normal conditions.

The Parent Company’s Risk Models function is in charge of controlling compliance with these limits. It reports any overruns to the parties delegated to their management, in addition to reporting situations where the alert value of said limits have been reached, as an early warning of a possible future overrun.

In accordance with standard management practices and with internal and external regulations, Banco BPM also conducted periodic stress testing, applying shocks, parallel or not parallel, to the curves of the currency rates utilised in the banking book. Furthermore, within the risk self-assessment process, the impact of historic and hypothetical scenarios (specific stress) is assessed, processed according to a method-based approach which takes into account the specific features of this risk, as well as a scenario common to all the risks (joint stress).

Risk Models also works with the structures in charge of risk management in order to identify and assess corrective measures aimed at compliance with the limits.

Liquidity risk Liquidity risk is the risk that the Group is not able to meet its payment commitments, and that this is certain or envisaged with reasonable certainty. Liquidity risk is usually broken down into two types of risk: funding and liquidity risk, namely the risk that the Group is unable, in the short term (liquidity) and in the long term (funding) to meet its payment commitments and its obligations in an efficient manner due to the inability to raise funds without prejudicing its core business activities and/or its financial situation; market liquidity risk, namely the risk that the Group is not able to liquidate an asset without incurring losses on the capital account due to the poor depth of the reference market and/or due to the timing with which the transaction must be performed.

Risk management model The Banco BPM Group had adopted internal policies and procedures with a view to stabilising the governance, management and control of liquidity and funding risk, and the Internal Liquidity Adequacy Assessment Process. The policies adopted seek to:

 pursue the sound and prudent management of liquidity in accordance with the 49 legislation in force and with the risk-return objectives approved in the Group’s Risk Appetite Framework;

 ensure that the Group operates with stable levels of liquidity and collections that are adequate to cover current payment commitments, future envisaged and unexpected commitments and to fund the Group’s banking business with stability.

Liquidity risk management and control policies are regulated in a specific internal Regulation, approved by the Management Bodies, which establishes the roles and responsibilities of corporate bodies and function, the approaches and the metrics to identify and measure the risk, the guidelines for stress testing and the Liquidity Contingency Plan (LCP), namely a plan of countermeasures that can be set activated in the event of internal or external liquidity pressure for the Group.

Liquidity risk is continuously managed and monitored as part of the Internal Liquidity Adequacy Assessment Process (ILAAP), which is the process adopted by the Group to identify, measure, monitor, mitigate and report its liquidity and funding risk profile from an operational perspective.

As part of this process, the Group also conducts an annual self-assessment as to the adequacy of the risk profile and of the overall framework to manage and measure liquidity risk with regard to governance, approaches, IT, measurement tools and reporting. This self- assessment is a fundamental aspect of the process to ensure the continuous internal improvement of liquidity risk supervision.

The results of the internal adequacy assessment are reported to the corporate Bodies and sent for information purposes to the Supervisory Authority.

Liquidity governance is centralised within the Parent Company, which also plays the role of lender of the last instance for the subsidiaries.

Reporting and monitoring system The Group measures and monitors exposure to liquidity and funding risk with regard to the current and future risk profile, in normal conditions and in stressed conditions.

More specifically, the Group uses a monitoring system that includes both short-term liquidity indicators (a time horizon from intra-day to twelve months) and medium-long term ones (beyond twelve months). To this end, regulatory metrics are also used (regulatory schedule that includes LCR, NSFR, ALMM) and metrics developed internally (internal schedule that includes survival period, gap ratio, indicators of funding concentration). The latter include the use of models to estimate behavioural parameters and/or optional parameters specific to the characteristics of the Banco BPM Group, with a view to integrating the regulatory metrics in terms of frequency or the scope of the analysis.

Liquidity risk monitoring and control is conducted on a daily basis (short-term liquidity) and a monthly basis (medium-long term liquidity). The objective is to monitor changes in the risk profile, verifying its adequacy with respect to the Risk Appetite Framework and the operating limits envisaged.

Stress testing is conducted on a quarterly basis, in order to test the Group’s resilience to 50 unfavourable scenarios and the liquidity estimates that may be generated with countermeasures (the so-called action plan, an integral part of the Liquidity Contingency Plan) that may be adopted in the event of a stress scenario.

The Group also has a reporting system to provide the Bodies, Committees and relevant corporate functions with evidence of monitoring activities, guaranteeing a prompt information with regard to the Group’s exposure to liquidity and funding risk.

Residual risk This is the risk that generally accepted techniques to mitigate credit risk used by the Group may be less effective than expected. To quantify it, the relevance of different types of Credit Risk Mitigation (CRM) tools is assessed in terms of reducing the capital requirement obtained thanks to their use.

The Banco BPM Group adopts a guarantee management process, which seeks to identify risk mitigation techniques to be used to limit exposure to credit risk, and to define methods to be implemented in the acquisition, management and enforcement of guarantees.

The processes adopted aim to increase the effectiveness of the coverage acquired, in terms of the actual possibility for the banks to enforce the guarantees and the recoverable value, in consideration of the recovery time frames and costs. For more information on the credit risk mitigation techniques and an assessment of their effectiveness, see the section of this Disclosure document devoted to this topic.

Risk deriving from securitisations This is the risk that a securitisation transaction carried out or structured by a company in the Group does not fully reflect the risk assessment and measurement decisions in line with the Group's policies; this risk does not consider self-securitisation transactions, and the assets transferred but not derecognised for accounting purposes, already included in credit risk.

The Group Finance Function is also in charge of monitoring those elements which could generate unexpected negative impacts on profit for the year, such as portfolio selection and definition of transaction structures, and review of legal documentation, including contractual and tort clauses.

More details regarding the treatment of this risk are provided in the specific section of this disclosure to the public.

Equity investment risk This is the risk resulting from changes in the value of equity investments held in the banking book due to market volatility or the status of the issuer.

Risk governance is performed with regard to financial instruments representing equity securities in the banking book, and stock investments made by the Group consolidated in equity.

The quantification of absorbed capital takes place using a VaR methodology (variance/covariance approach) instead of the standard regulatory approach. 51 Business risk Current and future risk linked to a potential fall in the interest margin with respect to the objectives set, due to low customer satisfaction with the products and services provided by the Group due to adverse market conditions.

Specifically, the Group is exposed to the risk of fluctuations in fee and commission income linked to investment services. This risk is managed and mitigated through commercial policies and actions aimed at building customer loyalty, so as to favour stable service provisions with a steady income flow, and at maintaining a high value added, innovative business offer in line with our customers’ present and future needs.

The Risk Function quantifies business risk according to a Pillar II view, based on an EaR - Earnings at Risk management methodology, which estimates the portion of net interest and other banking income at risk (net of components already measured in connection with other risk types), applying risk ratios determined on a historical analysis of volatility of said component.

The estimate is made with a confidence level of 99.9% and a one year holding period.

Strategic risk This is the current or future risk of a potential decrease in profits or capital as a result of incorrect market positioning or erroneous management decisions.

More specifically, it represents the risk that the competitive/strategic positioning choices do not produce the expected results, penalising the achievement of short and long-term economic and capital objectives, or even provoking unwanted decreases in profitability levels and capital soundness.

In this view, strategic risk related to the possibility of failure of company projects, which results in management disruption and inertia in the bank when faced with unforeseen market dynamics. The risk in question is evaluated through a qualitative-quantitative assessment process by an analyst, which produces an assessment of unexpected losses implicit in the business plan.

Reputational risk This is the risk linked to a negative perception of the bank’s image by customers, shareholders, investors, financial analysts and the Supervisory Authorities, which could have a negative influence on the bank’s ability to maintain or develop new business opportunities or to continue to have access to source of funding.

In addition to internal regulations, which govern general conduct for all Group employees, the various corporate functions monitor this risk, for the purpose of controlling quality and customer satisfaction objectives, managing complaints submitted by customers, managing relations with shareholders, and overseeing relations with financial analysts and institutional investors. This type of risk is also subject to managerial assessment carried through a specific internal assessment process that allows simultaneous verification of the Group's reputational position and quantification of a specific measure of economic capital.

52 Real estate risk Current and future risk resulting from changes in the value of the property held by the Group. Operationally, the Risk Function estimates the economic capital in the presence of this risk by means of a Value at Risk statistical method with a confidence interval of 99.9% and a one year holding period, a variance-covariance approach, applied to the market value of the real estate owned by the Group (including that purchased under financial lease).

Said method is applied with reference to non-operating assets; instead the standard regulatory approach is used for the other types.

Country risk Country risk is the risk of losses caused by events taking place outside Italy.

The concept of country risk is broader than that of sovereign risk, since it refers to all exposures irrespective of the nature of the counterparties, be they natural persons, businesses, banks or public administrations.

Transfer risk Transfer risk is the risk that a bank exposed to a party that obtains funding in a currency other than the currency of its main revenue sources may incur losses due to the debtor’s difficulty in converting its currency into the currency in which the exposure is denominated.

Risk of financial leverage This is the risk that a particularly high level of debt with respect to own funds could make the Bank vulnerable, requiring it to take corrective measures in its business plan, including selling assets at a loss, which could require recognising value adjustments on other assets as well.

ICT risk This is the risk of financial, reputational and market share losses due to the use of information and communication technology (ICT).

Compliance risk Compliance (or non-conformity) risk as defined by the supervisory provisions for banks (see Circular 285/2013) is the risk of incurring legal or administrative sanctions, significant financial losses or reputational damage as a result of the violation of binding rules (laws, regulations) or self-regulatory systems (e.g., Articles of Association, codes of conduct, corporate governance codes).

This type of risk is overseen at Group level, by the Parent Company’s Compliance Function. More specifically, the Compliance Function uses specialist structures and facilities to oversee compliance with rules regarding the exercise of banking, credit and brokering activities, conflicts of interest, investment services, transparency as regards customers and, more generally, provisions to safeguard consumers, governance and remuneration areas, ICT and data protection and security. 53 The structures and facilities oversee compliance with the rules through structures/resources specialised:

 in the prevention of compliance risk (ex ante), which is implemented through a process that continuously measures and analyses legislative changes and provides internal support to corporate structures for their correct application and,  in the performance of periodic checks (ex post), with a view to detecting any non- compliant behaviour or areas of vulnerability in corporate operating practices, which expose the Intermediary to significant compliance risk.

On a quarterly basis, the Compliance Function reports to Top Management Bodies on trends in compliance risk through the so-called Compliance Dashboard.

This report shows and aggregates the assessments made and indicates the overall level of compliance risk found at Group level and by individual Legal Entity.

Following the important changes which occurred during 2018 both relative to the reference European and national regulatory frameworks, and in the Group's organisational structure, deriving from implementation of the Group's Business Plan, during 2018 activities to strengthen compliance risk governance and management continued, with reference to all the regulatory areas monitored.

In 2018, the Compliance Function continued to provide support important projects to adapt to new legislative provisions scheduled to take effect in 2018/2019, regarding:

 PSD2 (Directive on Payment Services) represents the new legislative framework on payment services;

 MIFID II (Markets in Financial Instruments Directive II) represents the new harmonised legislative framework for investment firms, regulated markets, data reporting service providers and companies in third countries that provide investment services in the European Union;

 GDPR (General Data Protection Regulation) – EU Regulation 2016/679, which replaced and added to the Personal Data Protection Code (Legislative Decree 196/2003), with the aim of strengthening and rendering more homogeneous the protection of personal data for citizens and residents of the European Union, both internal and external to the confines of the EU;

 PAD (Payment Account Directive) - Directive 2014/92/EU has the goal of introducing new rules aimed at strengthening consumer protection and comparability of costs relative to consumer payment accounts;

 IDD (Insurance Distribution Directive) – European Directive 2016/97/EU introduces new requirements for those producing and distributing insurance products. The Directive requires that distributors of insurance products functionalise their internal operations, governance and relative internal procedures to protect the consumers contracting with them, with impacts on contracts, internal norms and processes and on IT systems. The Regulations took effect in February 2018;

54  FBR (Financial Benchmark Regulation) – the Regulation (EU) 2016/1011 on indexes used as references for financial instruments and in financial contracts, or to measure the performance of investment funds, introduces a shared regulatory framework, intended to ensure accuracy and integrity in the indexes used as reference (e.g. benchmarks) to determine the redemption and returns for financial products.

Model risk This is the risk that the model used in a measurement process or on the basis of which strategic decisions are made, generates an erroneous output due to an erroneous specification, defective execution or improper use of the model.

Execution risk Losses due to shortcomings in the finalisation of transactions or in the management of processes, as well as losses due to relations with commercial counterparties, sellers and suppliers.

Regulation risk This is the risk resulting from current regulatory changes that could influence the pursuit of the strategies identified by the Group.

Concentration of risks This is the risk that the exposure towards a single counterparty could lead to, at the same time, different types of risk.

Conduct risk This is the current and future risk of losses due to inadequacies in the financial services provided, including the risk of misconduct and improper treatment of customers. This risk is included under operational risk.

Outsourcing risk This is risk deriving from outsourcing/services contracts with partners external to the Group.

Geopolitical risk Risk deriving from geopolitical uncertainties in the European system.

Stress testing The Banco BPM Group has implemented a detailed stress testing framework, meaning a set of quantitative and qualitative techniques by means of which the bank assesses its vulnerability to exceptional but plausible events.

The framework also includes guidelines relating to the application of stress scenarios as well as the roles and responsibilities of the corporate functions and Corporate Bodies.

55 The framework for long-term forecasting and for stress testing adopted by Banco BPM comprises a coordinated set of methods, processes, controls and procedures that define the main variables to be used from a forward-looking perspective for estimates in normal and adverse conditions, for planning and risk management purposes as well as regulatory and managerial ones.

The stress tests seek to verify the effects on the risks of the bank due to specific events (sensitivity analysis) or joint changes in a series of economic-financial variables in cases of adverse scenarios (scenario analysis), with reference to individual risks (specific stress tests) or in an integrated manner on several risks (joint stress tests).

The analysis process is based on quantifying the firm-wide impacts relating to stress testing, which enable a global assessment in terms of the Bank’s risk profile.

These tests allow identification of the risk factors that contribute more than others to these negative results and consequently allow implementation of loss-limiting strategies when these scenarios occur.

Consistent with the aims of analysis and the principle of proportionality, the Group periodically performs stress tests with specific objectives associated with the main company processes, specifically:

 Definition of the Risk Appetite Framework (RAF)

 Recovery Plan

 Strategic and operational planning

 Quantification of operating limits

 Calculation of IFRS 9 ECL

 Internal Capital Adequacy Assessment Process (ICAAP)

 Internal Liquidity Adequacy Assessment Process (ILAAP)

 Liquidity Contingency Plan

 Short-Term Exercise (STE).

"Vertical" stress tests carried out at the individual portfolio and risk levels are also included in the context of stress tests, associated with sensitivity or scenario analyses, which also have the aim of identifying potential concentrations of risk.

In addition, specific stress tests are performed with managerial and regulatory goals (Supervisory Stress Test), these latter in accordance with the schedules issued time to time by the supervisory authorities.

In particular, in 2018 the Group was involved in executing the EU-Wide Stress Testing coordinated by the EBA/ECB, aimed at verifying the Group's resilience under a basic and adverse scenario. The type, complexity and level of detail of stress test methodologies are determined in line with the Group's strategic guidelines and business model, taking the trend in the macreconomic cycle into consideration.

56 The Group uses these tools to support other risk management and measurement techniques, with a view to:

 providing a forward-looking perspective of the risks, of the relative economic and financial impacts, assessing the overall soundness of the bank in the event of adverse or alternative scenarios with respect to the benchmarks, therefore providing support for the preparation of the budget and the business plan;

 overcoming the limitations arising from risk management models based on historical data (for example Historical VaR with reading of the last 250 observations);

 contributing to the most important planning and risk management processes, as regards setting RAF thresholds and establishing the Group’s risk/return objectives;

 assessing development of risk mitigation and recovery plans in certain stress situations. Stress tests are in fact used to define specific internal trigger thresholds which when reached trigger the activation of resolution plans as envisaged by the Bank Recovery and Resolution Directive (BRRD) relating to the prevention and management of bank and investment company crises.

Information Flows on risks (Risk area) The Risk Function generates the following documentation regarding risk information flows.

Integrated risk disclosure:

 Integrated risk report;

 ICAAP report;

 ILAAP report;

 Related Parties and Leveraged Transactions Report;

 Most Significant Transactions Report;

 Italian and European benchmarking.

Specific individual risk disclosure:

 Reporting on credit risk, with detailed analysis of the performing and non-performing AIRB portfolio, progress relative to the findings issued by the supervisory authorities and internal audit functions, methodological developments and the roll out plan;

 Reporting on market risk, with analysis of stop loss and VaR limit monitoring for the trading and banking books, monitoring of sensitivity limits, stress tests and backtesting; reporting on Group exposure to financial risks and the use of limits and any exceeding of managerial limits;

 Reporting on liquidity risk, containing monitoring of short-term liquidity with LCRs, operating liquidity, medium/long-term liquidity monitoring with the NSFR, and the result of stress tests, also with reference to the survival period and adequacy of action plans established in the Liquidity Contingency Plan (LCP); 57  Interest rate reporting relating to monitoring the risk of banking book value losses, the analysis of sensitivity to changes in market rates;

 Operational risk reporting with analyses of the capital requirement according to the combined TSA/AMA/BIA approach, losses reported/incurred in the reference historical timeframe, the historical distribution of losses, risk monitoring activities (continuous assessment), evidence of the RSA (risk self-assessment) process and the potential impact on risk in relation to new products/markets;

The table below summarises the main information flows to the governance bodies of the Parent Company Banco BPM and to the main Committees that develop the risk management policy.

Number Information flow name Recipient (Banco BPM)

1 Disclosure to the Public (Pillar III) BoD, BoSA, CICR, Risk Committee 2 Report on the internal capital adequacy assessment process (ICAAP) BoD, BoSA, CICR, Risk Committee 3 Report on the internal liquidity adequacy assessment process (ILAAP) BoD, BoSA, CICR, Risk Committee Report on the results of risk profile measurement/monitoring for all of the 4 BoD, BoSA, CICR, Risk Committee indicators and areas envisaged by the RAF ( Integrated Risk Report) Disclosure on the assessment of the Most Significant Transactions (MST) 5 BoD, BoSA, CICR, Risk Committee and Leveraged Transactions 6 Monitoring report on limits on exposures to Associated Parties BoD, BoSA, CICR, Risk Committee 7 Stress Testing Framework Report BoD, BoSA, CICR, Risk Committee RAF guidelines, Risk Appetite Framework and relative system of operating 8 BoD, BoSA, CICR, Risk Committee limits 9 Report on activities performed BoD, BoSA, CICR 10 Activity plan BoD, BoSA, CICR 11 Internal Validation Function Dashboard BoD, BoSA, CICR 12 Report on II level controls on Data Quality BoD, BoSA, CICR, Risk Committee 13 Report on interest rates, liquidity and monitoring of limits Finance Committee 14 Disclosure on market risk stress testing BoD, CICR, Risk Committee 15 Report on II level controls on credit BoD, BoSA, CICR, Risk Committee 16 Report on investment service activities BoD, BoSA, CICR, Risk Committee 17 Report on operational risks BoD, CICR, Risk Committee 18 Credit risk report Risk Committee 19 Benchmarking BoD, BoSA, CICR, Risk Committee 20 Annual RAF report BoD, BoSA, CICR, Risk Committee

It should also be noted that the Risk Function produces ad hoc reports on processes/assessments on the specific request of the Supervisory Authority, Corporate Bodies or Head of FAC.

Information flows on risks (Compliance area) With reference to compliance risk, in 2018 the Compliance Function continued to refine and strengthen its reporting model.

The model designed in accordance with the “Principles for the effective aggregation and reporting of risk data” issued by the Basel Committee for Bank Supervision in January 2013, was finalised with a view to meeting the information needs of the addressees, strengthening its ability to present summary risk data. 58 Furthermore, with a view to making the production of periodic reporting more efficient, the process of automatic generation for the Compliance dashboard is currently active. The model was designed at the Group level and at the level of the individual legal entities, to take the specific organisational, regulatory and business aspects of each entity into account. Nevertheless, in the Parent Company reporting lines, the information and data are also represented on an aggregate basis, in order to have an overall vision at Group level of corporate risk phenomena and of compliance activities.

Compliance Reporting meets in particular:

- the need for Top Management Bodies and Supervisory Authorities to understand the planning and reporting activities of the management cycle of the Compliance function;

- risk governance, control, monitoring and management purposes; - the need to support the Management decision-making process on any corrective action to be taken in the presence of high-risk situations;

- standardised coordination and guidelines for the supervisory activities of the audit functions. The main reports regard:

 Planning and revision activities;

 Management cycle stocktaking activities;

 Auditing activities;

 The exposure to compliance risk;

 The findings and relative action plans.

Adequacy of risk management measures Following the merger on 1 January 2017, the Banco BPM Group has acted to rationalise, harmonise and improve the tools, methods, processes and IT systems of the two former banks in compliance with Prudential Supervisory provisions (CRR Regulation, CRD4 Directive, Circular 285), beginning a multitude of projects over time aimed at improving its risk management and control system.

The risk management and control tools (models and controls) used were found to be suited to measuring and mitigating the risks to which the Group is exposed, also in the future and in stressed conditions.

Measurement models are periodically submitted to Internal Validation and Internal Audit. Risk measurement methodologies have been brought to the attention of the competent corporate bodies - the Board of Directors, the Risk Committee and the Board of Statutory Auditors. In addition, the breadth and detail of the ICAAP and ILAAP and the complexity/granularity of the Risk Appetite Framework make it possible to cover all risk governance areas. Measurement, monitoring and reporting to the control bodies are carried out periodically to guarantee rapid and effective risk management.

59 Consistency between the overall risk profile and business strategies The Banco BPM Group operates in such a way as to guarantee full integration between strategic/operational planning and the risk management system.

More specifically, as regards “Regulations for ICAAP” and “Regulations for liquidity risk, funding risk and ILAAP”, a connection has been established between the annual budget processes and the preparation of the strategic plan and the processes to prepare ICAAP and ILAAP Reports, regulating and illustrating, also through the exchange of specific information flows, the collaboration and coordination between the Risk Function and the Planning and Control Function. In the same way, the roles and collaborative activities amongst the above-mentioned Functions are defined within the “Risk Appetite Framework (RAF) Regulation” in order to define, update, verify and manage the Group’s Risk Appetite Framework.

During 2018, within the ICAAP, the sustainability of the Group's long-term projections was verified. The capital adequacy assessments were conducted on a prospective and stressed prospective basis.

The process, documented within company regulations, requires the application of a “basic” and various alternative “stress testing” scenarios by the Study and Research Function (Planning and Control Function).

The prospective internal capital and the stressed internal capital is calculated for each risk, and then compared with the RAF thresholds in force at that date.

60 Scope of application

Name of the bank to which the disclosure obligations apply Banco BPM Società per Azioni, Parent Company of the Banco BPM Banking Group.

Changes in the consolidation scope Changes in the scope of consolidation with respect to the situation at 31 December 2017 are reported in the following table:

Subsidiaries consolidated on a line-by-line basis Companies exiting due to the merger Name of incorporated company Name of incorporating company Banca Popolare di Milano S.p.A. Banco BPM S.p.A. Company exiting due to liquidation Pami Finance S.r.l. (in liquidation) Company exiting due to disposals % Mariner S.r.l. 100.00% Newly established incoming companies Beta S.r.l. in liquidation 100.00% First Servicing S.p.A. 100.00%

Companies consolidated with the equity method Companies exiting due to disposals % Renting Italease S.r.l 50.00%

With reference to the scope of related companies, we also note that, in the context of the process of reorganising the Bancassurance segment, in March, Banco BPM completed the purchase of 50% + 1 share of Avipop Assicurazioni and of Popolare Vita, taking its stake in the capital of the two companies to 100%. On the same date, Banco BPM sold 65% of the capital of Avipop Assicurazioni and of Popolare Vita to Cattolica Assicurazioni. As a result of these transactions, the Group now holds a 35% stake in the capital of the two companies, which, in May, changed their names to Vera Assicurazioni and Vera Vita. These interests continue to be classified as equity investments in associates and are measured with the equity method.

61 EU LI3 - Differences in scopes of consolidation (by entity)

Method of Method of accounting regulatory Description of the entity: consolidation: consolidation:

d y t i e t u a l d q e e d e a i e d t n n l

Name of the entity: i i n ' e c L L o s t o - - r s i u t c

y y Registered e n r d u b b o

d Sector Country o e l - - d c

p Offices d o

e e e

r o r h n n r D i i e o e P L L r h n t i a e h S N Other financial Agos-Ducato S.p.A. X X Milan ITALY companies Agriurbe S.r.l. (in Production X X Milan ITALY liquidation) companies Alba Leasing S.p.A. X X Leasing companies Milan ITALY Aletti & C. Banca di Investimento Mobiliare X X Banking system Milan ITALY S.p.A. Trust administration Aletti Fiduciaria S.p.A. X X Milan ITALY companies Aosta Factor S.p.A. X X Factoring companies Aosta ITALY Arcene Immobili S.r.l. (in Production X X Lodi ITALY liquidation) companies Arcene Infra S.r.l. (in Production X X Lodi ITALY liquidation) companies Insurance brokers, Arena Broker S.r.l. X X agents and Verona ITALY consultants Banca Akros S.p.A. X X Banking system Milan ITALY Banca Aletti & C. (Suisse) Banking system in X X Lugano SWITZERLAND S.A. non-EU countries Banco BPM S.p.A. X X Banking system Milan ITALY Private non-financial Beta S.r.l. (in liquidation) X X Lodi ITALY holdings Bipielle Bank (Suisse) S.A. in Banking system in X X Lugano SWITZERLAND liquidation non-EU countries Production Bipielle Real Estate S.p.A. X X Lodi ITALY companies Bipiemme Vita S.p.A. X X Insurance companies Milan ITALY Other financial BP Covered Bond S.r.l. X X Milan ITALY intermediaries Other financial BP Mortgages S.r.l. X X Milan ITALY intermediaries BP Property Management Production X X Verona ITALY Soc. Consortile a.r.l. companies BP Trading Immobiliare Production X X Lodi ITALY S.r.l. companies Other financial Conegliano BPL Mortgages S.r.l. X X ITALY intermediaries V. (TV) Other financial BPM Covered Bond 2 S.r.l. X X Rome ITALY intermediaries Other financial BPM Covered Bond S.r.l. X X Rome ITALY intermediaries Other financial BPM Securitisation 2 S.r.l. X X Rome ITALY intermediaries BPM Securitisation 3 S.r.l. in Other financial Conegliano X X ITALY liquidation intermediaries V. (TV) Production BRF Property S.p.A. X X Parma ITALY companies Bussentina S.c.a.r.l. (in Production X X Rome ITALY liquidation) companies

62 Method of Method of regulatory accounting Description of the entity: consolidation: consolidation:

d y t i e t u a l d q e e d a e i e d t n n l

Name of the entity: i i n ' e c L L o s t o - r - s i u t c

y y Registered e n r d u b b o

d Sector Country o e l - - d c

p Offices d o

e e e

r o r h n n r D i i e o e P L L r h n t i a e h S N

Calliope Finance S.r.l. (in Other financial Conegliano V. X X ITALY liquidation) intermediaries (TV) Consorzio AT01 X X Production companies Lodi ITALY Other financial Conegliano V. Erice Finance S.r.l. X X ITALY intermediaries (TV) Fund management Etica SGR S.p.A. X X Milan ITALY companies Other financial Factorit X X Milan ITALY intermediaries FIN.E.R.T. S.p.A (in Other financial X X Rome ITALY liquidation) companies First Servicing S.p.A. X X Production companies Milan ITALY GE.SE.SO. S.r.l. X X Production companies Milan ITALY GEMA Magazzini Generali Castelnovo di X X Production companies ITALY BPV-BSGSP S.p.A. Sotto (RE) Investment companies HI-MTF SIM S.p.A. X X Milan ITALY (SIM) Holding di Partecipazioni Private financial Finanziarie Banco Popolare X X Verona ITALY holdings S.p.A. Immobiliare Centro Milano X X Production companies Milan ITALY S.p.A. Immobiliare Marinai d’Italia X X Production companies Lodi ITALY S.r.l. Italfinance Securitisation Other financial Conegliano V. X X ITALY VH 1 S.r.l. intermediaries (TV) Italfinance Securitisation Other financial Conegliano V. X X ITALY VH 2 S.r.l. intermediaries (TV) Other financial Conegliano V. Leasimpresa Finance S.r.l. X X ITALY intermediaries (TV) Other financial Leviticus SPV S.r.l. X X Rome ITALY intermediaries Liberty S.r.l. (in liquidation) X X Production companies Lodi ITALY Lido dei Coralli S.r.l. X X Production companies Sassari ITALY Manzoni 65 S.r.l. X X Production companies Milan ITALY Meleti S.r.l. X X Production companies Lodi ITALY Milan Leasing S.p.A. (in X X Leasing companies Milan ITALY liquidation) Motia Compagnia di X X Production companies Venice ITALY Navigazione S.p.A. P.M.G. S.r.l. (in liquidation) X X Production companies Milan ITALY Partecipazioni Italiane Other financial X X Milan ITALY S.p.A. (in liquidation) companies Perca S.r.l. X X Production companies Lodi ITALY Profamily S.p.A. X X Financial companies Milan ITALY Other financial Conegliano V. Profamily Securitisation S.r.l. X X ITALY intermediaries (TV) Release S.p.A. X X Financial companies Milan ITALY S.E.T.A. Società Edilizia Tavazzano S.r.l. (in X X Production companies Milan ITALY liquidation) Sagim S.r.l. Società X X Production companies Asciano ITALY Agricola

63 Method of Method of regulatory accounting Description of the entity: consolidation: consolidation:

d y t i e t u a l d q e e d a e i e d t n n l

Name of the entity: i i n ' e c L L o s t o - r - s i u t c

y y Registered e n r d u b b o

d Sector Country o e l - - d c

p Offices d o

e e e

r o r h n n r D i i e o e P L L r h n t i a e h S N

Selma Bipiemme Leasing X X Financial companies Milan ITALY S.p.A. Sirio Immobiliare S.r.l. X X Production companies Lodi ITALY Società Gestione Servizi BP X X Production companies Verona ITALY Soc. Consortile p. az. Sviluppo Comparto 6 S.r.l. X X Production companies Lodi ITALY Sviluppo Comparto 8 S.r.l. X X Production companies Lodi ITALY Tecmarket Servizi S.p.A. X X Production companies Verona ITALY Terme Ioniche S.r.l. X X Production companies Lodi ITALY Terme Ioniche Società X X Production companies Cosenza ITALY Agricola S.r.l. Other financial Tiepolo Finance S.r.l. X X Lodi ITALY intermediaries Vera Assicurazioni S.p.A. X X Insurance companies Verona ITALY Vera Vita S.p.A. X X Insurance companies Verona ITALY

Current or foreseeable legal or substantive impediments to the prompt transfer of capital or funds within the group There are no restrictions that impede the rapid transfer of capital or funds within the Group.

Aggregate amount by which actual own funds fail to meet requirements for all affiliates not included in the scope of consolidation and names of such affiliates As at 31 December 2018, none of the affiliates not included in the scope of consolidation are required to meet the own funds requirements set forth in Regulation (EU) 575/2013 or Directive 2013/36/EU.

Name of the subsidiaries not included in the scope Please see the table in the previous section for the list of companies included in the scope of consolidation for statutory purposes but excluded from the prudential scope.

64 EU - LI1: Differences between accounting and regulatory scope of consolidation and reconciliation of balance sheet items with regulatory risk categories

Book values Book values of balance sheet items Book values on indicated in Subject to basis of regulatory Subject to Subject to Subject to Not subject to own fund published financial Subject to counterparty Subject to scope of counterparty counterparty securitisation requirements or equity statement credit risk risk (CCR): market risk consolidation risk (CCR) risk (CCR): SFTs scheme deduction documents Derivatives Asset 10. Cash and cash equivalents 922,017 922,015 922,015 - - 20. Financial assets designated at fair value through profit and - - - loss: a) financial assets held for 4,522,529 4,500,964 - 1,716,717 - 1,716,717 4,500,964 - trading b) other financial assets obligatorily designated at fair 1,216,066 1,216,066 - - - - 1,216,066 181,057 value 30. Financial assets measured at FV through Other 15,351,561 15,351,561 13,812,850 - - - 1,538,711 Comprehensive Income 40. Financial assets designated - - - - at amortised cost a) financial assets held for 4,377,526 3,808,052 3,049,883 758,169 758,169 - trading b) other financial assets obligatorily designated at fair 119,462,481 120,095,908 113,780,784 6,233,274 6,233,274 81,850 value 50. Hedging derivatives 130,511 125,516 - 125,516 125,516 - - 60. Value adjustment of financial assets subject to 42,173 42,173 - 42,173 42,173 - - macrohedging (+/-) 70. Equity investments 1,434,163 1,523,997 803,653 - 720,344 90. Property and equipment 2,775,885 2,489,688 2,489,688 - - 100. Intangible assets 1,277,941 1,274,412 - - 1,274,412 110. Tax assets 5,012,477 5,009,247 3,842,898 - 1,166,349 120. Non-current assets held for sale and discontinued 1,592,782 1,590,592 1,590,592 - - operations 130. Other assets 2,346,679 2,389,280 2,389,280 - Total assets 160,464,791 160,339,471 142,681,643 8,875,849 6,991,443 1,884,406 1,538,711 5,717,030 3,424,012

65 Book values Book values of balance sheet items Book values on indicated in Subject to basis of regulatory Subject to Subject to Subject to Not subject to own fund published financial Subject to counterparty Subject to scope of counterparty counterparty securitisation requirements or equity statement credit risk risk (CCR): market risk consolidation risk (CCR) risk (CCR): SFTs scheme deduction documents Derivatives Liability 10. Financial liabilities designated at amortised cost a) due to banks 31,633,541 31,632,049 8,194,818 8,194,818 23,437,231 b) due to customers 90,197,859 90,469,042 7,110,267 7,110,267 - 83,358,775 c) securities in issue 14,328,942 14,022,909 - 14,022,909 20. Financial liabilities held for 6,502,522 6,502,342 2,726,169 2,726,169 6,502,342 - trading 30. Financial liabilities designated 692,890 692,890 - 692,890 at fair value 40. Hedging derivatives 726,307 726,307 726,307 726,307 - 50. Value adjustment of financial liabilities subject to macrohedging 49,756 49,756 49,756 49,756 - (+/-) 60. Tax liabilities 505,402 487,231 148,592 - 338,639 70. Liabilities associated with non- current assets held for sale and 3,043 3,043 - 3,043 discontinued operations 80. Other liabilities 3,814,589 3,750,722 - 3,750,722 90. Employee severance 377,498 376,347 - 376,347 indemnity 100. Provisions for risks and 1,327,368 1,338,347 - 1,338,347 charges 120. Valuation reserves -346,438 -346,655 - 150. Reserves 3,577,955 3,570,574 - 170. Share capital 7,100,000 7,100,000 - 180. Treasury shares (-) -12,610 -12,610 - 190. Minority interests 45,599 43,491 - - 200. Profit/loss for the year -59,432 -66,314 - - Total liabilities 160,464,791 160,339,471 148,592 18,807,317 15,305,085 3,502,232 0 6,502,342 127,318,903

The breakdown of values in column b) in columns c) through f) was done using the following approach: • for asset items, based on the type of risk to which each item may be subject; • for liability items, considering the amount of the liabilities included when calculating risk-weighted exposures or used to offset asset elements. The sum of the values indicated in columns c) through g) may be greater than the amount in column b) in that certain elements are subject to multiple types of risk; With reference to tax assets and liabilities, the amounts shown in columns c) through g) are indicated net of deferred tax liabilities if allowable under the offsetting rules defined in the CRR.

66 EU - LI2: Main differences between amounts of exposures determined for regulatory purposes and book values determined on the basis of the regulatory consolidation scope

Exposures subject to Total Counterparty risk Counterparty risk Counterparty risk Securitisation Credit risk (CCR) (CCR): SFTs (CCR): Derivatives scheme Book value of assets based on regulatory consolidation scope 1 153,096,203 142,681,643 8,875,849 6,991,443 1,884,406 1,538,711 (as in table EU LI1) Book value of liabilities based on regulatory consolidation 2 18,955,909 148,592 18,807,317 15,305,085 3,502,232 - scope (as in table EU LI1) 3 Total net value on basis of regulatory scope of consolidation 134,140,294 142,533,052 -9,931,468 -8,313,642 -1,617,826 1,538,711

4 Off-balance-sheet amounts 12,533,601 12,533,601 -

5 Valuation differences 11,419,286 - 12,895,487 10,347,772 2,547,715 -1,476,201 Differences due to netting rules, with the exception of those 6 - already included in line 2 7 Differences due to treatment of value adjustments 7,848,800 7,848,800

8 Differences due to prudential filters -

9 Other -214,678 -214,678

10 Amounts of exposures considered for regulatory purposes 165,727,303 162,700,774 2,964,019 2,034,130 929,889 62,510

Comment on differences between the amounts of exposures determined for regulatory purposes and book values (notes relative to the table above) This table outlines the attribution of the book value on the regulatory consolidated scope (as shown in table EU Li1) and the value of the exposure subject to the regulatory requirement for positions subject to credit risk, counterparty risk, securitisation scheme. Following the EBA clarification (Q&A 2018/3836), regulatory exposure for positions subject to credit risk for the standardised method corresponds: - for equity items in the balance sheet at their book value after application of value adjustments on specific loans; - for off-balance-sheet items at nominal adjusted value based on the percentages established in the CRR. For positions subject to credit risk measured with internal models, corresponds to the EAD Note that this table does not include either exposures subject to market risks for which the concept of EAD is not entirely applicable nor exposures subject to deduction from own funds.

67 Reconciliation between the regulatory scope and the financial statement scope as at 31 December 2018

Banking Insurance Other Adjustments on Reclassified asset items (in thousands of euro) 31/12/2018 Group companies businesses consolidation

Cash and cash equivalents 922,015 2 0 922,017 Loans measured at AC (amortised cost) 108,271,685 6,866,253 -6,930,206 108,207,732 - Loans to banks 3,808,052 6,519,961 -6,134,894 4,193,119 - Loans to customers 104,463,633 346,292 -795,312 104,014,613 Other financial assets and hedging derivatives 36,826,382 4,926 21,634 36,852,942 - Measured at FVTPL 5,842,546 4,926 21,634 5,869,106 - Measured at FVOCI 15,351,561 0 0 15,351,561 - Measured at AC 15,632,275 0 0 15,632,275 Equity investments 1,523,997 15,966 -105,800 1,434,163 Property and equipment 2,489,688 260,861 25,336 2,775,885 Intangible assets 1,274,412 3,535 -6 1,277,941 Tax assets 5,009,247 10,790 -7,560 5,012,477 Non-current assets and asset disposal groups held for sale 1,590,592 2,190 0 1,592,782 Other assets 2,431,453 49,868 -92,469 2,388,852

Total 160,339,471 - 7,214,391 -7,089,071 160,464,791

Banking Insurance Other Adjustments on Reclassified liabilities (in thousands of euro) 31/12/2018 Group companies businesses consolidation

Due to banks 31,632,049 1,763,540 -1,762,048 31,633,541 Direct deposits 105,184,841 5,222,207 -5,187,357 105,219,691 - Due to customers 90,469,042 42,163 -313,346 90,197,859 - Securities and financial liabilities designated at 14,715,799 5,180,044 -4,874,011 15,021,832 fair value Other financial liabilities measured at FV 7,228,649 180 0 7,228,829 Liability provisions 1,714,694 10,752 -20,580 1,704,866 Tax liabilities 487,231 4,847 13,324 505,402 Liabilities associated with non-current assets held for sale and discontinued operations 3,043 0 0 3,043 Other liabilities 3,800,478 163,646 -99,779 3,864,345 Total liabilities 150,050,985 7,165,172 -7,056,440 150,159,717 Minority interests 43,491 0 2,108 45,599 Net Group equity 10,244,995 49,219 -34,739 10,259,475 Consolidated shareholders’ equity 10,288,486 49,219 -32,631 10,305,074 Total 160,339,471 - 7,214,391 -7,089,071 160,464,791 Total 160,339,471 - 7,214,391 -7,089,071 160,464,791

68 Details of the capital assets of other companies included in the scope of consolidation for statutory purposes but excluded from the prudential scope

Company name Total assets (Other businesses) 31/12/2018

1. Agriurbe S.r.l. in liquidation 13,478 2. Arena Broker S.r.l. 7,761 3. Beta S.r.l. in liquidation 100 4. BRF Property S.p.A. 11,638 5. Consorzio AT01 135 6. First Servicing S.p.A. 50 7. Immobiliare Marinai d’Italia S.r.l. 2,982 8. Leviticus SPV S.r.l. 10 9. Liberty S.r.l. - 10. Lido dei Coralli S.r.l. 14,175 11. Manzoni 65 S.r.l. 45,695 12. Meleti S.r.l. 260 13. Milano Leasing S.p.A. in liquidation 374 14. Partecipazioni Italiane S.p.A. in liquidation 4,906 15. Perca S.r.l. 3,091 16. P.M.G. S.r.l. in liquidation 11,398 17. Sagim S.r.l. Società Agricola 9,127 18. Sirio Immobiliare S.r.l. 9,337 19. Sviluppo Comparto 6 S.r.l. 3,073 20. Sviluppo Comparto 8 S.r.l. 152,623 21. Tecmarket Servizi S.p.A. 48,421 22. Terme Ioniche S.r.l. 13,643 23. Terme Ioniche Società Agricola S.r.l. 3,060 24. BP Mortgages S.r.l. 35 25. BP Mortgages 2007-1 133,766 26. BP Mortgages 2007-2 232,549 27. BPL Mortgages S.r.l. 101 28. BPL Mortgages 5 1,531,249 29. BPL Mortgages 7 2,767,095 30. BPM Securitisation 2 S.r.l. 191,829 31. BPM Securitisation 3 S.r.l. - 32. Profamily Securitisation S.r.l. 371,634 33. BP Covered Bond Residenziale 1,605,313 34. BP Covered Bond Commerciale - Erice Finance S.r.l. 35. Italfinance Securitisation VH 2 S.r.l. 17,101 Leasimpresa Finance S.r.l. 36. Italfinance Securitisation VH 1 S.r.l. 8,382 7,214,391

69 Own Funds

Template on the main features of equity instruments The following tables are based on the templates from Implementing Regulation (EU) no. 1423 of 20 December 2013, which lays out the implementing technical standards for disclosure of own fund requirements for institutions according to Regulation (EU) no. 575/2013 of the European Parliament and of the Council.

In particular, Annex II of the Regulation contains a specific template for publication of the main features of equity instruments.

The model requires a description of instruments issued by the institution and eligible for calculation within:

 Common Equity Tier 1 Capital;

 Additional Tier 1 Capital;

 Tier 2 Capital.

Amounts are shown in millions of euro.

70 Template on the main features of equity instruments (1) 1 Issuer BANCOBPMSPA BancoBPMS.p.A. Unique identifier (e.g., CUSIP, ISIN or Bloomberg identifier for 2 IT0005218380 XS0304963373 private placement) 3 Governing law(s) of the instrument Italian law English law Regulatory treatment 4 Transitional CRR rules Common Equity Tier 1 Capital Additional Tier 1 Capital 5 Post-transitional CRR rules Common Equity Tier 1 Capital Not eligible

Eligible at individual entity/(sub-)consolidation/individual entity 6 Individual entity and consolidation Individual entity and consolidated & (sub-)consolidation level Additional Tier 1 instrument pursuant to Art. 7 Instrument type (types to be specified for each jurisdiction) Ordinary shares 51, Art. 484 CRR and Art. 20 EU Regulation 2014/241 Amount recognised in regulatory capital (currency in millions, 8 at most recent reporting date) 7,087 105

9 Nominal amount of instrument N/A 105

9a Issue price N/A 100.00

9b Redemption price N/A 100.00

10 Accounting classification Shareholders' equity Liability - amortised cost 11 Original date of issuance N/A 21/06/2007 12 Perpetual or dated Perpetual perpetual 13 Original maturity date N/A N/A 14 Issuer call subject to prior supervisory approval NO YES

DATE: 21/06/2017 (reset date) Bullet repayment AMOUNT: Redemption at subsequent reset date and interest payment date: nominal plus accrued interest and additional Optional call date, contingent call dates and redemption amount due pursuant to Condition 9(a) 15 N/A amount (Taxation - Gross up); Regulatory Event or Tax Event: greater of (i) nominal amount and (ii) Make Whole Amount plus, in any event, accrued interest and any additional amount due pursuant to Condition 9(a) (Taxation - Gross up)

Each interest payment date (quarterly) 16 Subsequent call dates, if applicable N/A subsequent to 21/06/2017 Coupons/dividends 17 Fixed or floating dividends/coupons Floating Fixed then floating Fixed 6.756% p.a. until June 2017, then 3M 18 Coupon rate and any related index N/A Euribor + 188 bps 19 Existence of a dividend stopper mechanism NO NO

partially discretionary Reasons: the issuer does not have Fully discretionary, partially discretionary or mandatory (in distributable profits; if the payment results in 20a Fully discretionary terms of timing) a Capital Deficiency Event (failure to meet capital requirement); prohibition imposed by the supervisory authority; Fully discretionary, partially discretionary or mandatory (in 20b Fully discretionary partially discretionary terms of amount) 21 Existence of step up or other incentive to redeem N/A NO 22 Non-cumulative or cumulative Non-cumulative Non-cumulative 23 Convertible or non-convertible Non-convertible Non-convertible 24 If convertible, conversion trigger(s) N/A N/A 25 If convertible, fully or partially N/A N/A 26 If convertible, conversion rate N/A N/A 27 If convertible, mandatory or optional conversion N/A N/A 28 If convertible, specify instrument type convertible into N/A N/A 29 If convertible, specify issuer of instrument it converts into N/A N/A 30 Write-down features NO NO 31 If write-down, write-down trigger(s) N/A N/A 32 If write-down, full or partial N/A N/A 33 If write-down, permanent or temporary N/A N/A 34 If temporary write-down, description of write-back mechanism N/A N/A Position in subordination hierarchy in liquidation (specify 35 Additional Tier 1 Tier 2 instrument type immediately senior to instrument)

36 Non-compliant transitional features NO YES

payment not fully discretionary, dividend 37 If yes, specify non-compliant features N/A pusher

(1) N/A if the question is not applicable

71 Template on the main features of equity instruments (1) 1 Issuer Banco BPM S.p.A. Banco BPM S.p.A. Unique identifier (e.g., CUSIP, ISIN or Bloomberg identifier for 2 IT0004596109 XS0555834984 private placement) Entire instrument English law; 3 Governing law(s) of the instrument Italian law Subordination clauses: Italian law Regulatory treatment 4 Transitional CRR rules Additional Tier 1 Capital Tier 2 Capital 5 Post-transitional CRR rules Not eligible Tier 2 Capital Eligible at individual entity/(sub-)consolidation/individual entity 6 Individual entity and consolidated Individual entity and consolidated & (sub-)consolidation level Additional Tier 1 instrument pursuant to Art. 7 Instrument type (types to be specified for each jurisdiction) Tier 2 instrument pursuant to Art. 63 CRR 51 and art. 484 CRR Amount recognised in regulatory capital (currency in millions, 8 at most recent reporting date) 25 260 9 Nominal amount of instrument 25 710 9a Issue price 100.00 99.27 9b Redemption price 100.00 100.00 10 Accounting classification Liability - amortised cost Liability - amortised cost 11 Original date of issuance 29/03/2010 05/11/2010 12 Perpetual or dated perpetual on maturity 13 Original maturity date N/A 05/11/2020 14 Issuer call subject to prior supervisory approval YES NO DATE: 29/03/2020 Bullet repayment AMOUNT: Redemption at subsequent reset Optional call date, contingent call dates and redemption date and interest payment date: nominal 15 N/A amount plus accrued interest and any additional amount Regulatory Event or Tax Event: nominal plus accrued interest and any additional amount Each interest payment date (quarterly) 16 Subsequent call dates, if applicable N/A subsequent to 29/03/2020 Coupons/dividends 17 Fixed or floating dividends/coupons Fixed then floating Fixed fixed 9% p.a. until March 2020, then 3M 18 Coupon rate and any related index 6% fixed on a yearly basis Euribor + 665 bps 19 Existence of a dividend stopper mechanism NO NO partially discretionary Reasons: the issuer does not have Fully discretionary, partially discretionary or mandatory (in terms distributable profits; if the payment results in 20a Mandatory of timing) a Capital Deficiency Event (failure to meet capital requirement); prohibition imposed by the supervisory authority; Fully discretionary, partially discretionary or mandatory (in terms 20b partially discretionary Mandatory of amount) 21 Existence of step up or other incentive to redeem YES NO 22 Non-cumulative or cumulative Non-cumulative Non-cumulative 23 Convertible or non-convertible Non-convertible Non-convertible 24 If convertible, conversion trigger(s) N/A N/A 25 If convertible, fully or partially N/A N/A 26 If convertible, conversion rate N/A N/A 27 If convertible, mandatory or optional conversion N/A N/A 28 If convertible, specify instrument type convertible into N/A N/A 29 If convertible, specify issuer of instrument it converts into N/A N/A 30 Write-down features NO NO 31 If write-down, write-down trigger(s) N/A N/A 32 If write-down, full or partial N/A N/A 33 If write-down, permanent or temporary N/A N/A 34 If temporary write-down, description of write-back mechanism N/A N/A Position in subordination hierarchy in liquidation (specify 35 Tier2 Senior instrument type immediately senior to instrument) 36 Non-compliant transitional features YES NO Incentive to redeem, subsequent calls, 37 If yes, specify non-compliant features payment not fully discretionary, dividend N/A pusher (1) N/A if the question is not applicable

72 Template on the main features of equity instruments (1) 1 Issuer Banco BPM S.p.A. Banco BPM S.p.A. Unique identifier (e.g., CUSIP, ISIN or Bloomberg identifier for 2 XS0632503412 IT0005120313 private placement) Entire instrument English law; 3 Governing law(s) of the instrument Italian law Subordination clauses: Italian law Regulatory treatment 4 Transitional CRR rules Tier 2 Capital Tier 2 Capital 5 Post-transitional CRR rules Tier 2 Capital Tier 2 Capital Eligible at individual entity/(sub-)consolidation/individual entity 6 Individual entity and consolidated Individual entity and consolidated & (sub-)consolidation level 7 Instrument type (types to be specified for each jurisdiction) Tier 2 instrument pursuant to Art. 63 CRR Tier 2 instrument pursuant to Art. 63 CRR Amount recognised in regulatory capital (currency in millions, 8 at most recent reporting date) 153 358 9 Nominal amount of instrument 318 500 9a Issue price 99.26 100.00 9b Redemption price 100.00 100.00 10 Accounting classification Liability - amortised cost Liability - amortised cost 11 Original date of issuance 31/05/2011 30/07/2015 12 Perpetual or dated on maturity on maturity 13 Original maturity date 31/05/2021 30/07/2022 14 Issuer call subject to prior supervisory approval NO NO Optional call date, contingent call dates and redemption Early redemption option linked to regulatory 15 N/A amount events 16 Subsequent call dates, if applicable N/A N/A Coupons/dividends 17 Fixed or floating dividends/coupons Fixed Floating 18 Coupon rate and any related index 6.375%fixedonayearlybasis 3MEuribor+4.375% 19 Existence of a dividend stopper mechanism NO NO Fully discretionary, partially discretionary or mandatory (in terms 20a Mandatory Mandatory of timing) Fully discretionary, partially discretionary or mandatory (in terms 20b Mandatory Mandatory of amount) 21 Existence of step up or other incentive to redeem NO NO 22 Non-cumulative or cumulative Non-cumulative Non-cumulative 23 Convertible or non-convertible Non-convertible Non-convertible 24 If convertible, conversion trigger(s) N/A N/A 25 If convertible, fully or partially N/A N/A 26 If convertible, conversion rate N/A N/A 27 If convertible, mandatory or optional conversion N/A N/A 28 If convertible, specify instrument type convertible into N/A N/A 29 If convertible, specify issuer of instrument it converts into N/A N/A 30 Write-down features NO NO 31 If write-down, write-down trigger(s) N/A NO 32 If write-down, full or partial N/A N/A 33 If write-down, permanent or temporary N/A N/A 34 If temporary write-down, description of write-back mechanism N/A N/A Position in subordination hierarchy in liquidation (specify 35 Senior Senior instrument type immediately senior to instrument) 36 Non-compliant transitional features NO NO 37 If yes, specify non-compliant features N/A N/A (1) N/A if the question is not applicable

73 Template on the main features of equity instruments (1) 1 Issuer Banco BPM S.p.A. Banco BPM S.p.A. Unique identifier (e.g., CUSIP, ISIN or Bloomberg identifier for 2 IT0004966823 XS0597182665 private placement) 3 Governing law(s) of the instrument Italian law Italian law Regulatory treatment 4 Transitional CRR rules not eligible Tier 2 Capital 5 Post-transitional CRR rules not eligible Tier 2 Capital Eligible at individual entity/(sub-)consolidation/individual entity 6 N/A Individual entity and consolidated & (sub-)consolidation level 7 Instrument type (types to be specified for each jurisdiction) not eligible pursuant to Art. 65 CRR Tier 2 instrument pursuant to Art. 63 CRR Amount recognised in regulatory capital (currency in millions, 8 at most recent reporting date) - 193 9 Nominal amount of instrument 650 448 9a Issue price 100.00 99.60 9b Redemption price 100.00 100.00 10 Accounting classification Liability - amortised cost Liability - amortised cost 11 Original date of issuance 18/11/2013 01/03/2011 12 Perpetual or dated on maturity on maturity 13 Original maturity date 18/11/2020 01/03/2021 14 Issuer call subject to prior supervisory approval NO NO Optional call date, contingent call dates and redemption 15 N/A N/A amount 16 Subsequent call dates, if applicable N/A N/A Coupons/dividends 17 Fixed or floating dividends/coupons Fixed Fixed 18 Coupon rate and any related index 5.5% fixed on a yearly basis 7.125% annually 19 Existence of a dividend stopper mechanism NO NO Fully discretionary, partially discretionary or mandatory (in terms 20a Mandatory Mandatory of timing) Mandatory. The subordinated bonds constitute BPM 2nd level subordinated liabilities, so classified according to the supervisory legislation at the time of issue. Therefore, in Fully discretionary, partially discretionary or mandatory (in terms case of liquidation of the Bank, 20b Mandatory of amount) bondholders will only be reimbursed after all the other creditors of the Bank not equally subordinate have been satisfied, except for those with a degree of subordination equal to or more than that of the Subordinated Bonds. 21 Existence of step up or other incentive to redeem NO NO 22 Non-cumulative or cumulative Non-cumulative Non-cumulative 23 Convertible or non-convertible Non-convertible Non-convertible 24 If convertible, conversion trigger(s) N/A N/A 25 If convertible, fully or partially N/A N/A 26 If convertible, conversion rate N/A N/A 27 If convertible, mandatory or optional conversion N/A N/A 28 If convertible, specify instrument type convertible into N/A N/A 29 If convertible, specify issuer of instrument it converts into N/A N/A 30 Write-down features NO NO 31 If write-down, write-down trigger(s) N/A N/A 32 If write-down, full or partial N/A N/A 33 If write-down, permanent or temporary N/A N/A 34 If temporary write-down, description of write-back mechanism N/A N/A Position in subordination hierarchy in liquidation (specify 35 Senior Senior instrument type immediately senior to instrument) 36 Non-compliant transitional features NO NO 37 If yes, specify non-compliant features N/A Payment not fully discretionary (1) N/A if the question is not applicable

74 Template on the main features of equity instruments (1) 1 Issuer Banco BPM S.p.A. Unique identifier (e.g., CUSIP, ISIN or Bloomberg identifier for 2 XS1686880599 private placement) English law, except for subordination and 3 Governing law(s) of the instrument Loss Absorption Requirements which are regulated by Italian law. Regulatory treatment 4 Transitional CRR rules Tier 2 Capital 5 Post-transitional CRR rules Tier 2 Capital Eligible at individual entity/(sub-)consolidation/individual entity 6 Individual entity and consolidated & (sub-)consolidation level 7 Instrument type (types to be specified for each jurisdiction) Tier 2 instrument pursuant to Art. 63 CRR Amount recognised in regulatory capital (currency in millions, 8 at most recent reporting date) 500 9 Nominal amount of instrument 500 9a Issue price 100.00 9b Redemption price 100.00 10 Accounting classification Liability - amortised cost 11 Original date of issuance 21/09/2017 12 Perpetual or dated on maturity 13 Original maturity date 21/09/2027 14 Issuer call subject to prior supervisory approval YES In a lump sum on maturity except for regulatory events. The only option for the Optional call date, contingent call dates and redemption 15 issuer is to repay the loan, totally but not amount partially, on 21/09/2022 with the authorisation of the competent authority 16 Subsequent call dates, if applicable N/A Coupons/dividends Fixed with the parameter revision after 5 17 Fixed or floating dividends/coupons years 4.375% until 21/09/2022, then 5 years eur 18 Coupon rate and any related index mid swap rate + 4.179% 19 Existence of a dividend stopper mechanism NO Fully discretionary, partially discretionary or mandatory (in terms 20a Mandatory of timing) Mandatory. The subordinated bonds constitute "BANCO BPM 2nd level subordinated liabilities, so classified according to the supervisory legislation at the time of issue. Therefore, in Fully discretionary, partially discretionary or mandatory (in terms case of liquidation of the Bank, 20b of amount) bondholders will only be reimbursed after all the other creditors of the Bank not equally subordinate have been satisfied, except for those with a degree of subordination equal to or more than that of the Subordinated Bonds. 21 Existence of step up or other incentive to redeem NO 22 Non-cumulative or cumulative Non-cumulative 23 Convertible or non-convertible Non-convertible 24 If convertible, conversion trigger(s) N/A 25 If convertible, fully or partially N/A 26 If convertible, conversion rate N/A 27 If convertible, mandatory or optional conversion N/A 28 If convertible, specify instrument type convertible into N/A 29 If convertible, specify issuer of instrument it converts into N/A 30 Write-down features NO 31 If write-down, write-down trigger(s) N/A 32 If write-down, full or partial N/A 33 If write-down, permanent or temporary N/A 34 If temporary write-down, description of write-back mechanism N/A Position in subordination hierarchy in liquidation (specify 35 Senior instrument type immediately senior to instrument) 36 Non-compliant transitional features NO 37 If yes, specify non-compliant features N/A (1) N/A if the question is not applicable

75 Breakdown of Own Funds The tables of Own Funds (Regulatory Capital) and risk assets are presented below. They are calculated according to the rules mentioned in the introduction.

The breakdown of Own Funds at 31 December 2018 is also presented. This uses the template for the publication of information on own funds, in accordance with Annex IV of Implementing Regulation (EU) no. 1423 of 20 December 2013; compiled according to the pertinent instructions in Annex V.

BREAKDOWN OF OWN FUNDS 31/12/2018 31/12/2017

A. Common Equity Tier 1 Capital (CET1) before the application of prudential filters 10,222,102 11,868,333

of which CET1 instruments subject to transitional provisions 0 0

B. CET1 prudential filters (+/-) -35,515 -15,523

CET1 before items to be deducted and before the effects of the transitional C. 10,186,587 11,852,810 regime (A +/- B)

D. Items to be deducted from CET1 -3,780,568 -2,821,609

Transitional regime - Impact on CET1 (+/-), including non-controlling interests E. 1,348,227 347,481 subject to transitional provisions

F. Total Common Equity Tier 1 Capital (CET1) (C - D +/- E) 7,754,246 9,378,682

Additional Tier 1 Capital (AT1) before items to be deducted and before the G. 133,891 326,664 effects of the transitional regime

of which AT1 instruments subject to transitional provisions 129,900 322,015

H. Items to be deducted from AT1 0 0

Transitional regime - Impact on AT1 (+/-), including instruments issued by I. 0 -97,004 subsidiaries and included in AT1 by virtue of transitional provisions

L. Total Additional Tier 1 Capital (AT1) (G - H +/- I) 133,891 229,660

Tier 2 Capital (T2) before items to be deducted and before the effects of the M. 1,636,006 2,113,716 transitional regime of which T2 instruments subject to transitional provisions 0 71,533

N. Items to be deducted from T2 -82,203 -102,737

Transitional regime - Impact on T2 (+/-), including instruments issued by O. 0 -75,053 subsidiaries and included in T2 by virtue of transitional provisions

P. Total Tier 2 Capital (T2) (M - N +/- O) 1,553,803 1,935,926

Q. Total own funds (F + L + P) 9,441,940 11,544,268

76 Disclosure on the nature and amounts of specific items regarding own funds

AMOUNT Own funds disclosure template AT THE DISCLOSURE DATE Common Equity Tier 1 (CET1) Capital: instruments and reserves

1 Equity instruments and the related share premium reserves 7,100,000

Of which ordinary shares 7,100,000

3 Accumulated other comprehensive income (and other reserves) (*) 4,530,625

5 Non-controlling interests (amount permitted in consolidated Common Equity Tier 1 capital) 18,628

6 Common Equity Tier 1 (CET1) Capital before regulatory adjustments 11,649,253

Common Equity Tier 1 (CET1) Capital: regulatory adjustments

7 Additional write-downs (negative amount) -35,515

8 Intangible assets (net of the related tax liabilities) (negative amount) -996,501 Deferred tax assets that depend on future profitability, excluding those deriving from 10 temporary differences (net of the related tax liabilities for which the conditions pursuant to -1,042,895 Article 38, paragraph 3 are fulfilled) (negative amount) 12 Negative amounts resulting from the calculation of expected loss amounts -149,300 Own Common Equity Tier 1 Capital instruments held by the entity directly or indirectly 16 -12,610 (negative amount) Common Equity Tier 1 Capital instruments of subjects of the financial sector held directly or indirectly or synthetically by the entity, when the entity has a significant investment in these 19 -893,483 subjects (amount more than the threshold of 10% and net of eligible short positions) (negative amount) Deferred tax assets that derive from temporary differences (amount higher than the 21 threshold of 10% net of the related tax liabilities for which the conditions pursuant to Article -59,714 38, paragraph 3 are fulfilled) (amount negative) 22 Amount which exceeds the threshold of 15% (negative amount) -638,675 of which Common Equity Tier 1 Capital instruments of subjects of the financial sector held 23 directly or indirectly by the entity, when the entity has a significant investment in these -319,338 subjects 25 of which deferred tax assets that derive from temporary differences -319,338

25a Losses relative to the year in course (amount negative) -66,314

28 Total regulatory adjustments to Common Equity Tier 1 (CET1) Capital -3,895,007

29 Common Equity Tier 1 ( CET1) Capital 7,754,246

Additional Tier 1 (AT1) Capital: instruments Amount of eligible items pursuant to Article 484 (4) and the related share premium 33 129,900 reserves, subject to phase out from Additional Tier 1 Capital Eligible Tier 1 Capital included in consolidated additional Tier 1 Capital (including non- 34 3,991 controlling interests not included in line 5) issued by subsidiaries and held by third parties 36 Additional Tier 1 (AT1) Capital before regulatory adjustments 133,891

Additional Tier 1 (AT1) Capital: regulatory adjustments

43 Total regulatory adjustments to Additional Tier 1 (AT1) Capital 0

44 Additional Tier 1 (AT1) Capital 133,891

45 Tier 1 Capital (T1= CET1 + AT1) 7,888,137

(*) The item includes the transitional positive component, pursuant to paragraph 8 of Art. 473a CRR, aimed at mitigating the negative impact on own funds deriving from the introduction of the accounting standard IFRS 9.

77 Tier 2 (T2) Capital: instruments and provisions

46 Equity instruments and the related share premium reserves 1,464,637 Eligible own-fund instruments included in consolidated Tier 2 Capital (including non- 48 controlling interests and additional Tier 1 Capital instruments not included in line 5 or in line 5,322 34) issued by subsidiaries and held by third parties 50 Write-downs of loans 166,047

51 Tier 2 (T2) Capital before regulatory adjustments 1,636,006

Tier 2 (T2) Capital: regulatory adjustments Own Tier 2 Capital instruments held by the entity directly or indirectly and subordinated 52 -353 loans (negative amount) Tier 2 Capital instruments and subordinated loans of subjects of the financial sector held 55 directly or indirectly by the entity, when the entity has a significant investment in these -81,850 subjects (net of eligible short positions) (negative amount) 57 Total regulatory adjustments to Tier 2 (T2) Capital -82,203

58 Tier 2 (T2) Capital 1,553,803

59 Total Capital (TC = T1 + T2) 9,441,940

60 Total risk-weighted assets 64,324,066

Capital ratios and buffers

61 Common Equity Tier 1 Capital (as a percentage of the total risk exposure amount) 12.1%

62 Tier 1 Capital (as a percentage of the total risk exposure amount) 12.3%

63 Total Capital (as a percentage of the total risk exposure amount) 14.7% Capital buffer requirement specific to the entity (requirement related to Common Equity Tier 1 Capital, under the terms of Article 92, paragraph 1, letter a), plus capital 64 conservation buffer, counter-cyclical capital buffer, systemic risk capital buffer, capital 8.9% buffer of systemically important entities requirements, as a percentage of the risk exposure amount) 65 of which: capital conservation buffer requirement 1.9% Common Equity Tier 1 Capital available for the capital buffers (as a percentage of the risk 68 1.9% exposure) (**) Amounts less than the deduction thresholds (before risk weighting) Capital of subjects of the financial sector held directly or indirectly, when the entity does 72 not have a significant investment in these subjects (amount less than the threshold of 10 % 149,126 and net of eligible short positions) Common Equity Tier 1 Capital instruments of subjects of the financial sector held directly or 73 indirectly by the entity, when the entity has a significant investment in these subjects 799,789 (amount less than the threshold of 10% and net of eligible short positions) Deferred tax assets that derive from temporary differences (amount less than the threshold 75 of 10% net of the related tax liabilities for which the conditions pursuant to Article 38, 799,789 paragraph 3 are fulfilled) Maximums applicable for the inclusion of provisions in Tier 2 Capital Write-downs of loans included in Tier 2 Capital in relation to exposures subject to the 78 1,344,991 internal ratings-based approach (before application of the maximum) Maximum for inclusion of write-downs of loans in Tier 2 Capital in the context of the internal 79 166,047 ratings-based approach Capital instruments subject to phase-out (applicable only between 1 January 2014 and 1 January 2022)

82 - Current maximum on additional Tier 1 Capital instruments subject to phase-out 334,016

(**) The Common Equity Tier 1 Capital available for the buffers is expressed as a percentage of total risk- weighted assets, placing as numerator the Entity’s Common Equity Tier 1 Capital, from which the following elements have been subtracted: a) capital requirements referred to CET1 b) capital requirements referred to Tier1 for any portion covered with a surplus of CET1 c) capital requirements referred to Total Capital for any portion covered with a surplus of CET1.

78 Transitional arrangements aimed at mitigating the negative impact of the introduction of IFRS 9 on own funds Within the deadline provided for (1 February 2018), Banco BPM informed the European Central Bank that it had exercised the option to fully apply the transitional rules provided for in the new Article 473-bis of Regulation (EU) no. 575/2013, which extend over time the impact on own funds deriving from application of the new impairment model introduced by the accounting standard IFRS 9. These transitional rules provide for the option of including in Common Equity Tier 1 Capital a transitional positive component for a percentage of the increase made in provisions for expected losses on loans as a result of applying the accounting standard IFRS 9. This percentage decreases over five years as indicated below:

- period from 1 January to 31 December 2018: 95% of the increase made in provisions for expected losses on loans as a result of applying the accounting standard IFRS 9.

The negative impact expected to derive from applying the new impairment model on own funds is consequently reduced to 5% of the impact that will be recognised on the book value of shareholders’ equity as of 1 January 2018;

- period from 1 January 2019 to 31 December 2019: 85% of the increase made in provisions for expected losses on loans;

- period from 1 January 2020 to 31 December 2020: 70% of the increase made in provisions for expected losses on loans;

- period from 1 January 2021 to 31 December 2021: 50% of the increase made in provisions for expected losses on loans;

- period from 1 January 2022 to 31 December 2022: 25% of the increase made in provisions for expected losses on loans.

From 1 January 2023, the impact deriving from first adoption of the accounting standard IFRS 9 will be fully reflected in the calculation of own funds.

Besides the option to make gradual the impact deriving from first adoption of the accounting standard as of 1 January 2018, the transitional rules provide for the option to make gradual any impacts that applying the new impairment model will produce also in the first financial years after first adoption of the new accounting standard, although limited to those deriving from measurement of non-impaired financial assets.

The consequent disclosure obligations are complied with through the publication of Table IFRS9-FL below.

For the purposes of the calculation and representation of the aggregates in question, specific clarifications issued by the competent authorities are also applied.

79 IFRS 9-FL template - Comparison of own funds and of the capital leverage ratios of entities, with or without application of the transitional arrangements on the subject of IFRS 9 or analogous losses expected on loans

31/12/2018 30/09/2018

Capital available (amounts) Phase in Fully Ph. Phase in Fully Ph.

1 Common Equity Tier 1 ( CET1) Capital 7,754,246 6,406,018 8,448,331 7,100,104

2 Tier 1 Capital 7,888,137 6,410,010 8,582,527 7,104,399

3 Total capital 9,441,940 7,963,813 10,241,942 8,758,931

Risk-weighted assets (amounts)

4 Total risk-weighted assets 64,324,066 64,034,184 65,431,190 65,141,304

Capital ratios Common Equity Tier 1 Capital (as a 5 12.1% 10.0% 12.9% 10.9% percentage of the risk exposure amount) Tier 1 Capital (as a percentage of the risk 6 12.3% 10.0% 13.1% 10.9% exposure amount) Total Capital (as a percentage of the risk 7 14.7% 12.4% 15.7% 13.4% exposure amount) Leverage ratio Measurement of total exposure of the leverage 8 172,519,634 171,171,407 177,471,721 176,123,494 ratio 9 Leverage ratio 4.6% 3.7% 4.8% 4.0%

30/06/2018 31/03/2018

Capital available (amounts) Phase in Fully Ph. Phase in Fully Ph.

1 Common Equity Tier 1 ( CET1) Capital 8,701,179 7,212,615 8,678,647 7,284,049

2 Tier 1 Capital 8,835,405 7,216,942 9,006,083 7,288,375

3 Total capital 10,611,295 8,965,488 10,902,585 9,135,317

Risk-weighted assets (amounts)

4 Total risk-weighted assets 67,287,612 66,552,437 66,103,730 65,398,369

Capital ratios Common Equity Tier 1 Capital (as a 5 12.9% 10.8% 13.1% 11.1% percentage of the risk exposure amount) Tier 1 Capital (as a percentage of the risk 6 13.1% 10.8% 13.6% 11.1% exposure amount) Total Capital (as a percentage of the risk 7 15.8% 13.5% 16.5% 14.0% exposure amount) Leverage ratio Measurement of total exposure of the leverage 8 178,580,345 177,091,781 174,149,961 172,755,363 ratio 9 Leverage ratio 4.9% 4.1% 5.2% 4.2%

80 Reconciliation between Book value of equity and Own Funds

31/12/2018 31/12/2017

Consolidated equity (Statutory Group) 10,259,475 11,900,230

Credit standing adjustment, statutory vs. regulatory -14,480 -7,597

Book value of equity (Banking Group) 10,244,995 11,892,633

share of non-controlling interests 18,628 21,698

reversal of treasury shares 0 0

Profit/(loss) for the period provisionally not calculable 0 0

Valuation reserves -4,449 -8,926

Calculable instruments (Grandfathering) 0 0

Prudential filter on sale of property -37,072 -37,072

A. Common Equity Tier 1 Capital (CET1) before the application of prudential filters 10,222,102 11,868,333

of which CET1 instruments subject to transitional provisions 0 0

B. CET1 prudential filters (+/-) -35,515 -15,523 CET1 before items to be deducted and before the effects of the transitional C. 10,186,587 11,852,810 regime (A +/- B) D. Items to be deducted from CET1 -3,780,568 -2,821,609 Transitional regime - Impact on CET1 (+/-), including non-controlling interests E. 1,348,227 347,481 subject to transitional provisions F. Total Common Equity Tier 1 Capital (CET1) (C - D +/- E) 7,754,246 9,378,682 Additional Tier 1 Capital (AT1) before items to be deducted and before the effects G. 133,891 326,664 of the transitional regime of which AT1 instruments subject to transitional provisions 129,900 322,015

H. Items to be deducted from AT1 0 0 Transitional regime - Impact on AT1 (+/-), including instruments issued by I. 0 -97,004 subsidiaries and included in AT1 by virtue of transitional provisions L. Total Additional Tier 1 Capital (AT1) (G - H +/- I) 133,891 229,660 Tier 2 Capital (T2) before items to be deducted and before the effects of the M. 1,636,006 2,113,716 transitional regime of which T2 instruments subject to transitional provisions 0 71,533

N. Items to be deducted from T2 -82,203 -102,737 Transitional regime - Impact on T2 (+/-), including instruments issued by O. 0 -75,053 subsidiaries and included in T2 by virtue of transitional provisions P. Total Tier 2 Capital (T2) (M - N +/- O) 1,553,803 1,935,926

Q. Total own funds (F + L + P) 9,441,940 11,544,268

81 Reconciliation of the Book Value of and Regulatory Shareholders’ Equity with the elements of Common Equity Tier 1 Capital , Additional Tier 1 Capital and Tier 2 Capital, with an indication of the filters and deductions applied to Own Funds and of the impacts of the Transitional Arrangements

Relevant Accounting figures Ref. “Own Funds amount for ASSET ITEMS disclosure purposes of Statutory scope Prudential scope template” table own funds 030. Financial assets measured at FV -15,351,561 -15,351,561 194,000 23 through Other Comprehensive Income 040. Financial assets designated at -123,840,007 -123,903,960 -81,850 55 amortised cost 070. Equity investments -1,434,163 -1,523,997 -1,418,602 8 19 23 100. Intangible assets -1,277,941 -1,274,412 -1,274,412 8 110. Tax assets -5,012,477 -5,009,247 -1,421,946 10 21 25 Grand total -4,002,810

Relevant Accounting figures Ref. “Own Funds amount for LIABILITY ITEMS disclosure purposes of Statutory scope Prudential scope template” table own funds 010.c. Debt securities in issue 14,328,942 14,022,909 1,464,284 46 52 060. Tax liabilities 505,402 487,231 289,693 8 120. Valuation reserves -346,438 -346,655 -351,105 3 150. Reserves 3,577,955 3,570,574 3,570,574 3 170. Share capital 7,100,000 7,100,000 7,100,000 1 180. Treasury shares -12,610 -12,610 -12,610 16 190. Non-controlling interests (+/-) 45,599 43,491 27,941 5 34 48 200. Profit (Loss) for the period -59,432 -66,314 -66,314 25a Grand total 12,022,463

OTHER ELEMENTS FOR THE RECONCILIATION OF OWN -55,840 3 7 12 50 FUNDS Negative amounts resulting from the calculation of expected losses with A-IRB models -149,300 12 Write-downs of loans A-IRB 166,047 50 Additional write-downs (negative amount) -35,515 7 Prudential filters generated by sale of property -37,072 3 TRANSITIONAL ARRANGEMENTS - IMPACT ON CET1 1,348,227 3 (+/-) Transitional impacts of IFRS9 955,965 3 DTAs above threshold (for transitional impacts of IFRS9) 255,597 3 Significant equity investments above threshold (for transitional impacts of IFRS9) 136,665 3 TRANSITIONAL ARRANGEMENTS - IMPACT ON AT1 (+/-) 129,900 33 Amount of eligible items pursuant to Article 484 (4) subject to phase out from additional 129,900 33 Tier 1 Capital TRANSITIONAL ARRANGEMENTS - IMPACT ON T2 (+/-) 0 0

TOTAL OWN FUNDS AT 31 December 2018 9,441,940

82 Analysis of changes in own funds aggregate during 2018

(in thousands of euro) 31/12/2018

Common Equity Tier 1 Capital (CET1) Initial balance 9,378,682 CET1 instruments -645,485 Increase/Decrease in valuation reserves of financial assets measured at fair value -593,667 Distribution of dividends - Net income for the period -66,314 Change in capital 1,536 Change in other reserves (including IFRS9 effects)* 19,536 Change in non-controlling interests included in CET1 -6,576 Prudential filters -19,992 Change in regulatory value adjustments (prudent valuation) -19,992 Deductions -958,960 Increase/Decrease in goodwill and intangible fixed assets (net of tax liabilities) 4,425 Increase/Decrease in significant investments in CET1 instruments and tax assets subject to -626,184 deduction threshold Increase/Decrease in deferred tax assets fully deductible from CET1 -232,578 Increase/Decrease in non-significant investments in CET1 instruments - Surplus of expected losses compared to value adjustments -104,623 Final balance 7,754,246 Additional Tier 1 (AT1) Capital Initial balance 229,660 AT1 instruments -192,773 Increase/Decrease in AT1 instruments calculable under Grandfathering arrangements -192,115 Change in non-controlling interests included in AT1 -658 Deductions 97,004 Increase/Decrease in elements to be deducted from AT1 97,004 Final balance 133,891 Tier 2 (T2) Capital Initial balance 1,935,926 T2 instruments -424,337 Increase/Decrease in T2 subordinated instruments -407,686 Decrease in T2 instruments calculable under Grandfathering arrangements -71,533 Change in non-controlling interests included in Tier2 -877 IRB Entities - Surplus of value adjustments with respect to expected losses 55,760 Deductions 42,214 Reduction in items to be deducted from T2 42,214 Final balance 1,553,803 Total Own Funds 9,441,940

(*) The item includes the transitional positive component pursuant to paragraphs 7 a) and 8 of Art. 473a CRR aimed at mitigating the negative impact on own funds deriving from the introduction of the accounting standard IFRS 9

83 Note that, on the basis of that established in article 26, paragraph 2 of Regulation EU 575/2013 of 26 June 2013 (CRR), the value of common equity tier 1 subsequently detailed takes into account the economic result at the end of the year.

From 1 January 2018, most of the transitional effects provided for in Part Ten of Regulation (EU) 575/2013 are no longer applicable. At the same time Delegated Regulation (EU) 2017/2395 has come into force; this introduced the new article 473-bis of the CRR, aimed at mitigating the negative impact of the introduction of IFRS 9 on own funds.

At 31 December 2018, Common Equity Tier 1 ( CET1) Capital showed a decrease of approximately 1,624 million, deriving mainly from an increase in elements to be deducted and in negative prudential filters, of which:

- 66 million as the net result for the period

- 233 million for fully-deductible deferred tax assets;

- 105 million for excess of expected losses with respect to write-downs;

- 626 million for significant equity investments and DTAs exceeding the threshold pursuant to Art. 48 CRR;

- 20 million for “Additional Valuation Adjustments”.

The total changes in shareholders’ equity reserves reflect, above all, the negative trend in unrealised capital losses on financial assets measured at fair value of 593 million.

The other reserves, including the negative reserve for the impact of first adoption of the standard IFRS 9, also include the partial recovery provided for in the new Art. 473 bis CRR and generated a positive balance of approximately 20 million.

Additional Tier 1 (AT1) Capital decreased by 95 million. With own eligible instruments extinguished for approximately 192 million, the pre-existing items to be deducted for negative transitional impacts, of 97 million, were reduced to zero.

In Tier 2 (T2) Capital, there was a net decrease of 382 million.

Eligible instruments issued by the bank itself decreased by approximately 479 million, owing to regulatory amortisation and redemptions of securities that had reached maturity, among the last allowed under the grandfathering regime.

Items to be deducted showed a positive net balance of 42 million due to the reduction to zero of negative transitional impacts, which were offset by subordinated loans to significant investees.

The higher value adjustments on A-IRB credit risks, already mentioned for CET1, resulted in a surplus compared to expected losses, calculated in Tier 2 within the regulatory limits, resulting in a positive change of 56 million.

84 Capital Requirements

Disclosure with respect to Pillar 1 capital adequacy pursuant to Article 92 of the CRR Regulation On the basis of current prudential supervisory provisions ("Regulations for the supervision of banks" - Bank of Italy Circular no. 285 of 17 December 2013), the minimum Total Capital Ratio is set at 10.5% (including the capital conservation buffer, which is set at 2.5% as of 2019).

In mid-February 2019, Banco BPM received a notification from the European Central Bank of the SREP decision containing the outcomes of the annual Supervisory Review and Evaluation Process (SREP). The capital requirements laid down by the ECB for the year 2019, in terms of Common Equity Tier 1 ratio, are presented below.

Banco BPM Group’s Capital Requirements - in terms of CET1 ratio 2018 2019 Pillar 1 Regulatory minimum 4.50 % 4.50 % Pillar 2 Requirement(P2R) 2.50 % 2.25 % Total SREP Capital Requirement (TSCR) 7.00 % 6.75 % Capital Conservation Buffer (CCB) 1.88 % 2.50 % Buffer Other Systemically Important Institution (O-SII) 0.00% 0.06 % Overall Capital Requirement (OCR) 8.88 % 9.31 %

The minimum capital requirement is equal to the sum of the capital requirement prescribed against credit, counterparty, market and operational risks. These requirements, in turn, arise from the sum of the individual requirements of the companies in the Group’s prudential consolidation scope, after removing the effects of intra-group relations on credit, operational and counterparty risks.

As of 1 January 2017, with the establishment of the Banco BPM Group, the Supervisory Authority has agreed to the use of internal models employed by the former Banco Popolare Group and by Banca Akros to calculate the capital requirements of the new Group on their respective pre-existing validation perimeters.

As of 31 December 2018, the Banco BPM Group is authorised to use its own internal models to calculate regulatory capital absorption with reference to the following Pillar 1 risks:

 credit risk (starting with the measurement at 30 June 2012) € the scope concerns the advanced internal rating based approaches (PD, for both monitoring and acceptance and LGD) relating to retail and business loans made by Banco BPM spa. For loan portfolios not falling within the scope of initial AIRB validation, the standard regulatory approach continues to be applied for prudential purposes. During 2017, the Banco BPM Group presented a request for an extension to the European Central Bank, with a simultaneous model change with regards to the definition of defaults and an updating of the historic series and internal advanced models (AIRB) for the BPM S.p.A. corporate and retail portfolio, as well as the use of the EAD model limited to the retail perimeter, for the relative calculations of capital 85 requirements against credit risk. In this context, the Group received authorisation from the ECB to make use of these models for reporting purposes in the first quarter of the first half of 2018, effective starting with the reporting as of January 2018;

 market risk (starting with the reporting on 30 June 2007 for Banca Akros and 30 June 2012 for Banco BPM spa and Banca Aletti). During 2018, the Parent Company's internal model was extended to Banca Akros4. At present, the perimeter includes generic and specific risk for equity securities and generic risk for debt securities in the trading book. In 2018, projects were begun to extend the internal model for specific risk of debt securities and exchange risk for the Banking Book;

 operating risk: the former Banco Popolare Group had adopted the Advanced Measurement Approach for the first validation perimeter (relative to the companies Banco Popolare, Banca Aletti, SGS BP and BP Property Management5, with initial reporting in June 2014) and the roll-out perimeter shared with the Regulator (with references to operating segments Aletti Gestielle SGR and BP Leasing Division - former Banca Italease, initial reporting on 30 June 2016). For the relevant companies of the Group (parent company and all companies which over time were incorporated into it, Banca Akros and ProFamily), the former BPM Group had adopted the Traditional Standardised Approach as of 2008. The other residual companies of the two former Group had adopted the Basic Indicator Approach as of 2008. Following the merger date, the Banco BPM Group was authorised by the European Supervisory Authority to use the combined Advanced Measurement Approach (AMA), relating to the validated perimeter of the former Banco Popolare Group (former Banco Popolare segments of the Parent Company, Banca Aletti, SGS BP, and BP Property Management), the Traditional Standardised Approach (TSA) on the perimeter of the former Banca Popolare di Milano Group (segments of the former parent company BPM Scarl, the former BPM Spa, ProFamily and Banca Akros) and the Basic Indicator Approach (BIA) for the other residual companies that comprise the Banco BPM Group. In 2017, the Banco BPM Group began a project to extend advanced approaches to the former BPM component, for managerial purposes. As of reporting on 30 June 2018, in line with the decision adopted by the ECB on the issue, the private banking segments of the former BPM SpA and Banca Akros, transferred to Banca Aletti, adopted the advanced approach. As of reporting on 31 December 2018, in line with the decision adopted by the ECB on the issue, the Corporate & Investment Banking segments of Banca Aletti, transferred to Banca Akros, are subject to the standardised approach (TSA).

The capital requirements and capital ratios of the Banco BPM Group as at 31 December 2018 are presented as follows.

4 As of 1 October 2018, the Corporate Investment Banking business unit of Banca Aletti was transferred to Banca Akros. 5 As of 1 January 2019, SGS and BP Property Management have been incorporated into the Parent Company Banco BPM. 86 Capital requirements and capital ratios of Banco BPM Group

31/12/2018 31/12/2017

Information Weighted Weighted Requirements Requirements amounts amounts

B. Regulatory Capital Requirements B.1 Credit and Counterparty Risk 56,177,956 4,494,236 67,381,808 5,390,544 1. Standard Approach 28,466,159 2,277,293 48,997,678 3,919,815 2. Internal models - Basic - - - - 3. Internal models - Advanced 27,711,797 2,216,943 18,384,130 1,470,729

B.2 Credit valuation adjustment - CVA - risk 180,633 14,451 319,533 25,563

B.3 Regulatory risk 64,884 5,191 21,347 1,708 B.4 Market risk 1,858,688 148,696 2,573,112 205,849 1. Standard Approach 429,250 34,341 501,177 40,094 2. Internal models 1,429,438 114,355 2,071,935 165,755 3. Concentration risk - - - - B.5 Operational Risk 5,872,577 469,806 5,600,641 448,051 1. Basic Approach 136,123 10,890 165,553 13,244 2. Standardised Approach 2,670,128 213,610 2,682,219 214,577 3. Advanced Approach 3,066,326 245,306 2,752,869 220,230 B.6 Other calculation elements 169,328 13,546 0 0 B.7 Total Capital Requirements 64,324,066 5,145,926 75,896,441 6,071,715

C. Capital adequacy ratios (%) C.1 Common Equity Tier 1 Ratio 12.1% 12.4% C.2 Tier 1 Ratio 12.3% 12.7% C.3 Total Capital Ratio 14.7% 15.2%

Qualitative disclosure on countercyclical capital buffer The imposition of additional capital buffers with respect to the regulatory minima has the objective of giving banks high-quality capital resources to be used in moments of market tension to prevent dysfunctions of the banking system and avoid breakdowns in the loan disbursement process and to cope with the risks deriving from the systemic importance at the global or domestic level of certain banks. In this context, the counter-cyclical capital buffer has the aim of protecting the banking sector in the stages of excessive growth of credit. In fact, its imposition makes it possible to accumulate, during phases of credit cycle overheating, Common Equity Tier 1 Capital, which will then be destined to absorb losses in the descending phases of the cycle (from Circular 285 - Part One – Transposition in Italy of the CRD IV directive Section III – Counter-cyclical capital buffer).

Entities have an obligation to hold a countercyclical capital buffer equal to their total exposure to risk multiplied by the bank’s specific countercyclical ratio. The Bank of Italy, like the other authorities designated by the individual Member States, has an obligation to determine quarterly the countercyclical ratio of our country and to monitor the congruity of the ratios applied by other countries, both EU and non-EU.

87 Directive 2013/36/EU specifies that the specific countercyclical ratio of an entity is equal to the weighted average of the countercyclical ratios applied in the countries in which the significant exposures of the entity are situated.

It should be noted that Bank of Italy set at 0% the countercyclical ratio to be applied to exposures held with Italian counterparties, for the fourth quarter of 2018.

The detailed information in the following tables is published in accordance with Commission Delegated Regulation (EU) 2015/1555 dated 28 May 2015.

Amount of institution-specific countercyclical capital buffer

Line Column

010

010 Total risk exposure amount 64,324,066

020 Institution specific countercyclical ratio 0%

030 Institution specific countercyclical capital buffer requirement -

88 Geographical distribution of loan exposures relevant for the calculation of the countercyclical capital buffer

General credit exposures Trading book exposure Securitisation exposure

Sum of Value of Exposure long and Exposure Line Exposure trading book Exposure value for IRB short value for IRB value for SA exposure for value for SA approach position of approach (000) internal (000) (000) trading (000) models (000) book (000)

10 20 30 40 50 60

Breakdown by country

275 CZ CZECH REPUBLIC 0 0 0 0 0 0

31 GB UNITED KINGDOM 9,512 0 1,078 0 0 0

103 HK HONG KONG 0 0 0 0 0 0

41 IS ICELAND 0 0 0 0 0 0

10 48 NO NORWAY 0 0 0 0 0 0 Country: 68 SE SWEDEN 0 0 0 0 0 0

259 LT LITHUANIA 0 0 0 0 0 0

276 SK SLOVAKIA 0 0 0 0 0 0

OTHER COUNTRIES WITH RATIO OF ZERO 21,821,290 96,390,007 846,172 0 54,864 7,632

20 21,830,803 96,390,007 847,251 0 54,864 7,632

Requirement Own fund requirements weighting factors

Countercyclical Line Of which: Of which: Of which: ratio general trading securitisation loan book Total (000) own funds exposures exposures exposures (000) (000) (000)

70 80 90 100 110 120

Breakdown by country

275 CZ CZECH REPUBLIC 0 0 0 0 - 1.25

31 GB UNITED KINGDOM 753 86 0 840 0 1

103 HK HONG KONG 0 0 0 0 0 1.875

41 IS ICELAND 0 0 0 0 - 1.25

10 48 NO NORWAY 0 0 0 0 - 2 Country: 68 SE SWEDEN 0 0 0 0 - 2

259 LT LITHUANIA 0 0 0 0 - 0.5

276 SK SLOVAKIA 0 0 0 0 - 1.25

OTHER COUNTRIES WITH RATIO OF ZERO 3,729,958 2,703 7,565 3,740,227 99.978

20 3,730,711 2,790 7,565 3,741,066 100.000

89 Capital requirement for Credit and Counterparty Risk (Standard Approach)

CAPITAL REQUIREMENT REGULATORY PORTFOLIO 31/12/2018 31/12/2017

Exposures to or guaranteed by central administrations and central banks 293,113 294,526

Exposures to or guaranteed by regional administrations or local authorities 5,401 6,208

Exposures to or guaranteed by non-profit entities and public sector entities - -

Exposures to or guaranteed by public sector organisations 29,257 28,715

Exposures to or guaranteed by multilateral development banks - -

Exposures to or guaranteed by international organisations - -

Exposures to or guaranteed by intermediaries subject to supervision 379,050 503,571

Exposures to or guaranteed by enterprises 546,018 1,466,459

Retail exposures 118,954 310,524

Exposures guaranteed by property 23,952 291,731

Exposures in default status 166,915 483,277

High risk exposures 93,948 23,346

Exposures in the form of covered bank bonds 1,558 1,697

Short-term exposures to enterprises or supervised intermediaries - -

Exposures to undertakings for collective investment in transferable securities (UCITS) 92,757 105,575

Equity exposures 191,847 150,937

Other exposures 329,009 246,266

Securitisations: Total Exposure 4,595 6,391

Pre-funded contributions to the Guarantee Fund: Total Exposure 919 592

TOTAL CREDIT AND COUNTERPARTY RISK 2,277,293 3,919,815

Capital requirement for Counterparty Risk

CAPITAL REQUIREMENT REGULATORY PORTFOLIO 31/12/2018 31/12/2017 Counterparty Risk 69,937 75,385

The requirement is already included in the capital requirement for credit and counterparty risk, as set out in the previous tables.

Capital requirement for Credit Valuation Adjustment (CVA) Risk

CAPITAL REQUIREMENT REGULATORY PORTFOLIO 31/12/2018 31/12/2017 Credit Value Adjustment - CVA - risk 14,451 25,563

The requirement is determined through the standard approach and applied to exposures in OTC derivatives traded with financial counterparties, excluding intra-group exposures and those to Central Counterparties.

90 Capital requirement for Credit and Counterparty Risk (IRB Approach)

CAPITAL REQUIREMENT REGULATORY PORTFOLIO 31/12/2018 31/12/2017

Exposures to or guaranteed by enterprises

Specialised loans 0 0

SMEs 824,051 497,698

Other businesses 789,710 483,312

Retail exposures

Exposures guaranteed by residential property: SMEs 106,252 73,863

Exposures guaranteed by residential property: natural persons 185,864 190,072

Qualified retail revolving exposures 12,620 13,480

Other retail exposures: SMEs 270,888 178,088

Other retail exposures: natural persons 24,574 33,982

Securitisation exposures

Internal ratings-based approach - Total exposure 2,984 234 TOTAL 2,216,943 1,470,729

Capital requirement for Market Risk

CAPITAL REQUIREMENT REGULATORY PORTFOLIO 31/12/2018 31/12/2017

Market risks (Position, exchange-rate and commodity)

- Standardised approach 34,341 40,094

Position risk on debt instruments 27,147 28,478

Position risk on equity instruments - 4

Exchange rate risk 6,194 11,604

Commodity risk 1,000 8

- Internal models 114,355 165,755

Internal models: total 114,355 165,755

TOTAL MARKET RISKS 148,696 205,849

CAPITAL REQUIREMENT REGULATORY PORTFOLIO 31/12/2018 31/12/2017

Settlement risk 5,191 1,708

Positions included in regulatory trading book 5,191 1,708

Positions included in banking book - -

91 EU MR1 - Market risk on the basis of the standardised approach

RWAs Capital Requirements

Products other than options

1 Interest rate risk (generic and specific) 339,327 27,146

2 Equity risk (generic and specific) - -

3 Exchange rate risk 77,424 6,194

4 Risk associated with raw materials 12,500 1,000

Options

5 Simplified approach - -

6 Delta-plus approach - -

7 Scenario approach - -

8 Securitisation (specific risk) - -

9 Total 429,251 34,340

Capital requirement for Operational Risk

CAPITAL REQUIREMENT REGULATORY PORTFOLIO 31/12/2018 31/12/2017

Basic Indicator Approach 10,890 13,244

Standardised Approach 213,610 214,577

Advanced Approaches 245,306 220,230

TOTAL OPERATIONAL RISK 469,806 448,051

92 EU OV1 – Overview of risk-weighted asset (RWA) exposures

RWAs Min. req. 31/12/2018 30/09/2018 31/12/2018 1 Credit risk (excluding CCR) (*) 55,197,519 55,861,058 4,415,801 Article 438, letters c) and 2 Of which with standardised approach 27,655,969 27,605,916 2,212,477 d) Article 438, letters c) and 3 Of which with basic IRB approach (IRB Foundation) - - - d) Article 438, letters c) and Of which with advanced IRB approach (IRB 4 27,541,550 28,255,142 2,203,324 d) Advanced Of which equity instruments with IRB on the basis of Article 438, letter d) 5 the simple weighting approach or with the Internal - - - Model Approach (IMA) Article 107 Article 438, letters c) and 6 CCR 1,066,333 1,130,879 85,307 d) Article 438, letters c) and 7 Of which market value approach 413,914 398,440 33,113 d) Article 438, letters c) and 8 Of which original exposure - d) 9 Of which with standardised approach (**) 460,293 550,446 36,823 10 Of which with internal model method (IMM) - - - Of which the amount of exposure to risk for Article 438, letters c) and 11 contributions to the guarantee fund of a central 11,493 7,428 920 d) counterparty (CCP) Article 438, letters c) and 12 Of which CVA 180,633 174,565 14,451 d) Article 438, letter e) 13 Settlement risk 64,884 13 5,191 Article 449, letters o) and Securitisation exposures included in the banking 14 94,737 104,417 7,579 i) book (taking into account the maximum) 15 Of which with IRB approach 37,299 38,041 2,984 Of which with IRB Supervisory Formula Approach 16 - - - (SFA) 17 Of which with Internal Assessment Approach (IAA) - - - 18 Of which with standardised approach 57,438 66,376 4,595 Article 438, letter e) 19 Market risk 1,858,689 2,291,594 148,696 20 Of which with standardised approach 429,251 537,289 34,340 21 Of which with IMA 1,429,438 1,754,305 114,355 Article 438, letter e) 22 Large exposures 0 0 0 Article 438, letter f) 23 Operational risk 5,872,576 5,943,229 469,806 24 Of which with basic indicator approach 136,122 165,553 10,890 25 Of which with standardised approach 2,670,128 2,621,912 213,610 26 Of which with advanced approach 3,066,326 3,155,764 245,306 Article 437, paragraph 2, Amounts below the deduction thresholds (subject to 27 2,563,819 2,824,126 205,106 Article 48 and Article 60 risk weighting of 250 %) Article 500 28 Adjustments for application of the minimum threshold 0 Additional amount for exposure to risk due to Article Article 3 29 169,328 100,000 13,546 3, CRR 30 Total 64,324,066 65,431,190 5,145,926

(*) The figure relates only to credit risk. The associated components referred to counterparty risk (CCR), contributions to the guarantee fund of a central counterparty (CCP) and securitisation transactions are, therefore, excluded. They are shown separately in the same statement. The amounts in line 27 fulfil the obligation to publish pursuant to paragraph 1) letter d) detail iii) and paragraph 2) of Article 437 of Regulation 575/2013 (CRR). They are already included in the amounts in line 1 calculated according to Article 92, paragraph 4 of the same regulation and therefore not included in the grand total. (**) Includes CCR risk not subject to IMM models whose RWAs, for credit risk purposes, are reported with the IRB approach.

93 EU CR8 - Statement of changes in RWAs of exposures subject to credit risk on the basis of the IRB approach

Amounts of RWAs Capital Requirements 1 RWAs at the end of the previous reporting period 28,255,142 2,260,411 2 Amount of the assets 33,033 2,643 3 Quality of the assets -772,655 -61,812 4 Updates to the model 0 5 Approach and policy 0 6 Acquisitions and disposals 0 7 Changes in exchange rates 0 8 Other 26,030 2,082 9 RWAs at the end of the reporting period 27,541,550 2,203,324

EU MR2-B - Statement of changes in RWAs of exposures subject to market risk on the basis of the IMA approach

Total capital VaR SVaR Total RWA requirements 1 RWAs at the end of previous quarter 348,507 1,405,798 1,754,305 140,344 1a Regulatory adjustment 51,122 262,435 313,558 25,084

RWAs at the end of previous quarter (end 1b 297,385 1,143,363 1,440,747 115,260 of day)

2 Changes in risk levels -90,931 -219,220 -310,151 -24,812 3 Updates/changes to the model 4 Approach and policy 5 Acquisitions and disposals 6 Changes in exchange rates 25,912 56,964 82,876 6,630 7 Other

RWAs at end of reporting period (end of 8a 232,365 981,106 1,213,472 97,078 day)

8b Regulatory adjustment 53,448 162,518 215,966 17,277

8 RWAs at the end of the reporting period 285,813 1,143,625 1,429,438 114,355

94 Disclosure with respect to Pillar 2 capital adequacy pursuant to Article 73 of CRD IV Directive The process of assessing capital adequacy supports and supplements the consistency check conducted under Pillar 1, which requires the verification of the adequacy of Own Funds in terms of the minimum prudential requirements for credit risk (including counterparty risk), market risk and operational risk.

Significant risks (credit, counterparty, market, interest rate, operational and other measured risks) are measured using statistic and quantitative methods generally relating to the VaR technique.

Banco BPM Group has opted for a level of probability (or confidence interval) of 99.90%, in line with the confidence level of minimum capital requirements established by supervisory regulations, in order to make the reconciliation with estimates resulting from the application of regulatory approaches easier.

The risks are estimated with reference to a one-year horizon, with the exception of market risks, for which a 10-day holding period is used for market risk on the trading book (the default risk component is estimated with a 3-months holding period).

For Banking Book market risk, a ten day holding period is used for the stock and exchange component. Risk on the HTC portfolio is estimated with a 6-month holding period. For the HTCS portfolio, the VaR Spread method includes a 3-week holding period (the risk default component - IDR is estimated with a 3 month horizon).

For the banking book equity instrument risk the, holding period is 6 months.

The assessment of capital adequacy carried out in the ICAAP context and included in the Group’s Risk Appetite framework entails, besides the quantification of all the significant risks, the definition of the measure of total capital used as capital amount to cover the same business risks.

The Group’s Risk Appetite Framework includes indicators that make it possible to monitor and assess the Group’s Pillar Two capital adequacy with the related fixing of the Trigger, Tolerance and Capacity thresholds.

Among the Strategic indicators there is, for example, the capital buffer indicator in the Pillar II context defined as the difference between the amount of own Available Financial Resources (AFRs) and the total economic capital.

In addition, in the same context of Pillar II capital adequacy, the Group has decided to adopt a definition of its Available Financial Resources (AFRs) broader than Own Funds, considering also some components that have the immediate availability feature, despite the fact that current legislation does not allow full computability or imposes the deduction from Own Funds.

This amount must not be limited merely to covering total risk capital, but must also be able to:

95 - expand for growth beyond what is defined in the strategic plan, ensuring potential flexible operational margins;

- manage business continuity should cumulative losses recorded over the twelve months exceed those estimated according to the assumed confidence level;

- handle situations where market developments could be substantially worse than forecast and incorporated in the risk estimate models;

- maintain an additional capital buffer, for the purpose of maintaining/improving the level of capitalization, with a view to improving rating agency judgements;

- pursue the target ratio objectives established by the Top Management.

Internal capital adequacy of Pillar 2 is also assessed (ordinary and stressed conditions) in order to identify any imbalance between the evolution of risk which may be prudently forecast based on the objectives defined during strategic and budget planning, and the internal generation of capital through self-financing and the specific management of this process.

To guarantee this continuous monitoring, Banco BPM Group has adopted an advanced system for risk integration and quantification of available capital resources, with advanced functions of management, control, reporting and simulation of capital adequacy conditions.

The economic capital or total internal capital (total risks) thus determined is also assessed including the outcome of stress tests. Specifically, the combined impacts on various risk factors of macroeconomic scenarios, characterised by stress conditions, are considered.

The Risk Unit measures and, as a result, assesses Pillar II capital adequacy on a monthly basis and sends specific reporting in this regard to the Governance Bodies.

This monitoring makes it possible to verify compliance with the thresholds defined within the Group Risk Appetite Framework.

96 Credit Risk - General information regarding all banks

Definition of "past due" and "impaired" loans and methods used to determine writedowns

Definitions of "past due" and "impaired" loans used for accounting purposes Impaired Banco BPM Group exposures are classified into the following categories, in line with that established under the prudential supervisory regulations:

- impaired past due and/or exceeded credit lines: these are exposures which at the reference date have amounts past due or exceeding credit lines by more than 90 days. This category includes positions for which the amount past due and/or exceeding the credit line exceeds the relevance threshold of 5% of the total exposure, on the basis of the rules found in the regulatory instructions governing in detail the technical methods used for calculation;

- unlikely to pay: these are exposures which the Bank holds it unlikely that the debtor will fully fulfil their obligations (capital and/or interest) without the use of actions such as enforcement of guarantees;

- default: these are exposures regarding loans to customers who are insolvent, even if not legally ascertained, relative to which targeted collection actions are carried out, total or partial (for capital and interest).

Description of methods adopted to determine writedowns

Exposures classified as "performing" The Banco BPM Group adopts an incurred loss metric to calculated collective writedowns (in line with the IASB international standards), based on Basel 2 risk factors (PD and LGD), a cyclical factor with the objective of expressing a specific credit standing assessment able to reflect current market conditions and a corrective factor (loss confirmation period) used to "transform" the managerial concept of expected loss into the accounting concept of losses incurred but not reported.

For more information, please see that found in the section "Credit Risk: disclosure on portfolios to which IRB approaches are applied".

Exposures classified as "past due" and "impaired" The method used by the Banco BPM Group to estimate expected losses on impaired loans identifies the specific risk for a given position on the basis of the amount of the exposure, technical macroforms, type of customer and type of guarantees supporting the transaction. This makes use of the Expected Loss Best Estimate LGD, applied in a lump sum manner to all past due and/or over established credit line positions and to probable default or default exposures under an established threshold. Probable default or defaulted positions exceeding the pre-established limits are measured analytically by the managers. 97 Exposures with sovereign nations At 31 December 2018, total exposures held by the Group relative to sovereign states amounted to 27,533.6 million, broken down as follows by individual country (amounts in thousands of euros):

of which of which Country Debt securities Parent Loans Parent Total Company Company Italy 17,650,778 17,057,921 0 0 17,650,778

Spain 1,553,055 1,553,055 0 0 1,553,055

Portugal 0 0 0 0 0

Ireland 19,908 19,908 0 0 19,908

Germany 954,990 954,989 0 0 954,990

Greece 0 0 0 0 0

France 3,179,563 3,179,563 0 0 3,179,563

Austria 140,215 140,215 0 0 140,215

Other EU countries 178,613 178,610 0 0 178,613

Total EU countries 23,677,122 23,084,261 0 0 23,677,122

USA 3,856,397 3,856,393 0 0 3,856,397

Great Britain 0 0 0 0 0

Hungary 0 0 0 0 0

Argentina 87 87 0 0 87

Canada 0 0 0 0 0

Brazil 0 0 0 0 0

Total other countries 3,856,484 3,856,480 0 0 3,856,484

Total as at 31 December 2018 27,533,606 26,940,741 0 0 27,533,606

Exposure is mainly concentrated within the Parent Company Banco BPM which, as of 31 December, holds a total of 26,940.7 million, mainly in Italian government securities.

Investments in sovereign debt securities relative to EU countries are designated in the portfolio of financial assets designated at fair value through profit and loss for around 3%, 43% are in the portfolio of financial assets designated at fair value through other comprehensive income and the remaining 54% is classified in financial assets designated at amortised cost.

98 Credit exposures by type of exposure Impaired assets Non-impaired assets s s e e n n

r r e e l r r u u w w a s s u i u o s o

t Total (net f s s o o r f d d

REGULATORY/QUALITY PORTFOLIOS o o p p a o e e p p t t

x x exposure) p i e i

t x x r r e e l i

r e e w a w s s

t t t s s l w l o e e o o a a T r r t t N N o o G G T T 1. Financial assets designated at amortised cost 11,851,365 -5,111,452 6,739,913 -390,120 117,548,483 -384,436 117,164,047 123,903,960

2. Financial assets measured at FV through Other Comprehensive Income 0 0 0 0 14,864,243 -9,515 14,854,728 14,854,728

3. Financial assets designated at fair value 0 0 0 0 0 0 0 0

4. Other financial assets obligatorily designated at fair value 323,880 -184,539 139,341 0 0 0 368,963 508,304

5. Financial assets held for sale 6,157,084 -4,826,258 1,330,826 -653,801 246,029 -707 245,322 1,576,148

Total as at 31 December 2018 18,332,329 -10,122,249 8,210,080 -1,043,921 132,658,755 -394,658 132,633,060 140,843,140

Total at 31 December 2017 (*) 25,597,891 -12,496,544 13,101,347 - 127,886,355 -320,250 127,574,097 140,675,444

(*) Values determined in compliance with accounting standard IAS 39, restated for comparative homogeneity

Exposures by portfolio and credit quality Impaired Non- Other non- Unlikely to REGULATORY/QUALITY PORTFOLIOS Default past due impaired past impaired Total pay loans due loans exposures

1. Financial assets designated at amortised cost 1,591,510 5,060,868 87,535 1,767,325 115,396,722 123,903,960

2. Financial assets measured at FV through Other Comprehensive Income 0 0 0 0 14,854,728 14,854,728

3. Financial assets designated at fair value 0 0 0 0 0 0

4. Other financial assets obligatorily designated at fair value 3,656 135,685 0 1,448 367,515 508,304

5. Financial assets held for sale 1,330,000 164 662 6,664 238,658 1,576,148

Total as at 31 December 2018 2,925,166 5,196,717 88,197 1,775,437 130,857,623 140,843,140

Total at 31 December 2017 (*) 6,487,692 6,533,230 80,425 2,585,437 124,988,660 140,675,444

(*) Values determined in compliance with accounting standard IAS 39, restated for comparative homogeneity

99 Geographical distribution of cash and off-balance-sheet credit exposures with customers

ITALY OTHER EU COUNTRIES AMERICAS ASIA REST OF WORLD s s s s s n n n n n

e e e e e Total - Total - r r r r r w w w w w Total - Net u u u u u o o o o o

EXPOSURES/GEOGRAPHIC AREAS s s s s s Total Gross d d d d d

o o o o o exposure e e e e e p p p p p t t t t t writedowns exposure i i i i i x x x x x r r r r r e e e e e w w w w w

t t t t t l l l l l e e e e e a a a a a t t t t t N N N N N o o o o o T T T T T

A. Cash exposures

A.1 Default 2,914,763 -7,166,634 9,137 -11,623 519 -126 461 -5,480 222 -214 2,925,102 -7,184,077 10,109,179

A.2 Unlikely to pay 5,145,348 -2,846,013 30,081 -35,844 104 -6,877 21,184 -15,017 0 0 5,196,717 -2,903,751 8,100,468

A.3 Impaired past due loans 88,164 -18,858 32 -10 1 -1 0 0 0 0 88,197 -18,869 107,066

A.4 Non-impaired exposures 114,616,255 -384,024 8,271,789 -1,895 4,577,431 -890 148,240 -28 18,657 -8 127,632,372 -386,845 128,019,217

Total (A) 122,764,530 -10,415,529 8,311,039 -49,372 4,578,055 -7,894 169,885 -20,525 18,879 -222 135,842,388 -10,493,542 146,335,930

B. Off-balance-sheet exposures

B.1 Impaired exposures 1,556,247 -80,028 22,812 0 0 0 0 0 0 0 1,579,059 -80,028 1,659,087

B.2 Non-impaired exposures 51,442,264 -43,033 3,398,084 -110 514,777 -2 10,579 -3 231,388 0 55,597,092 -43,148 55,640,240

Total (B) 52,998,511 -123,061 3,420,896 -110 514,777 -2 10,579 -3 231,388 0 57,176,151 -123,176 57,299,327

Total (A+B) at 31 December 2018 175,763,041 -10,538,590 11,731,935 -49,482 5,092,832 -7,896 180,464 -20,528 250,267 -222 193,018,539 -10,616,718 203,635,257

Total (A+B) at 31 December 2017 (*) 144,961,357 -12,722,950 5,006,399 -162,253 2,048,890 -22,940 191,846 -9546 12,728 -222 152,221,220 -12,917,911 165,139,131

(*) Values determined in compliance with accounting standard IAS 39, restated for comparative homogeneity

100 Geographical distribution of cash and off-balance-sheet credit exposures with banks

ITALY OTHER EU COUNTRIES AMERICAS ASIA REST OF WORLD s s s s s n n n n n

e e e e e Total - Total - r r r r r w w w w w Total - Net u u u u u o o o o o

EXPOSURES/GEOGRAPHIC AREAS s s s s s Total Gross d d d d d

o o o o o exposure e e e e e p p p p p t t t t t writedowns exposure i i i i i x x x x x r r r r r e e e e e w w w w w

t t t t t l l l l l e e e e e a a a a a t t t t t N N N N N o o o o o T T T T T

A. Cash exposures

A.1 Default 0 0 64 -258 0 0 0 0 0 0 64 -258 322

A.2 Unlikely to pay 0 -15,294 0 0 0 0 0 0 0 0 0 -15,294 15,294

A.3 Impaired past due loans 0 0 0 0 0 0 0 0 0 0 0 0 0

A.4 Non-impaired exposures 3,848,853 -5,153 2,686,714 -2,143 365,074 -243 70,227 -43 206,207 -227 7,177,075 -7,809 7,184,884

Total (A) 3,848,853 -20,447 2,686,778 -2,401 365,074 -243 70,227 -43 206,207 -227 7,177,139 -23,361 7,200,500

B. Off-balance-sheet exposures

B.1 Impaired exposures 0 0 0 0 0 0 0 0 0 0 0 0 0

B.2 Non-impaired exposures 1,617,263 -247 838,028 -104 100,019 -27 629,876 -187 169,466 -90 3,354,652 -655 3,355,307

Total (B) 1,617,263 -247 838,028 -104 100,019 -27 629,876 -187 169,466 -90 3,354,652 -655 3,355,307

Total (A+B) at 31 December 2018 5,466,116 -20,694 3,524,806 -2,505 465,093 -270 700,103 -230 375,673 -317 10,531,791 -24,016 10,555,807

Total (A+B) at 31 December 2017 (*) 5,836,959 -16,626 2,084,226 -416 293,202 -1,225 105,999 -30 240,558 -4 8,560,944 -18,301 8,579,245

(*) Values determined in compliance with accounting standard IAS 39, restated for comparative homogeneity

101 Sector distribution of cash and off-balance-sheet credit exposures with customers

Financial companies Public administrations Financial companies (including insurance EXPOSURES/COUNTERPARTIES companies) Net Total Net Total Net Total exposure writedowns exposure writedowns exposure writedowns A. Cash exposures A.1 Default 77 -268 50,862 -120,144 0 0 of which subject to forbearance 0 0 11,107 -23,222 0 0 A.2 Unlikely to pay 2,314 -1,752 171,408 -249,298 0 0 of which subject to forbearance 0 0 86,328 -137,757 0 0 A.3 Impaired past due loans 5 -2 620 -106 0 0 of which subject to forbearance 0 0 0 0 0 0 A.4 Non-impaired exposures 29,166,549 -11,535 16,982,859 -19,782 314,348 -363 of which subject to forbearance 3,551 -5 7,379 -143 0 0 Total (A) 29,168,945 -13,557 17,205,749 -389,330 314,348 -363 B. Off-balance-sheet exposures B.1 Impaired exposures 3,689 -12 103,456 -577 0 0 B.2 Non-impaired exposures 4,822,928 -69 3,663,971 -5,432 137,935 -20 Total (B) 4,826,617 -81 3,767,427 -6,009 137,935 -20 Total (A+B) at 31 December 2018 33,995,562 -13,638 20,973,176 -395,339 452,283 -383 Total (A+B) at 31 December 2017 (*) 27,407,237 -6,117 16,541,429 -457,236 384,374 -370 (*) Values determined in compliance with accounting standard IAS 39, restated for comparative homogeneity

Non-financial companies Households Total EXPOSURES/COUNTERPARTIES Net Total Net Total Net Total exposure writedowns exposure writedowns exposure writedowns A. Cash exposures A.1 Default 2,442,987 -5,793,962 431,176 -1,269,703 2,925,102 -7,184,077 of which subject to forbearance 247,479 -443,600 26,813 -53,831 285,399 -520,653 A.2 Unlikely to pay 4,327,498 -2,474,466 695,497 -178,235 5,196,717 -2,903,751 of which subject to forbearance 2,648,652 -1,398,916 348,656 -74,608 3,083,636 -1,611,281 A.3 Impaired past due loans 55,144 -10,872 32,428 -7,889 88,197 -18,869 of which subject to forbearance 9,755 -1,439 4,554 -663 14,309 -2,102 A.4 Non-impaired exposures 49,455,390 -245,819 32,027,574 -109,709 127,632,372 -386,845 of which subject to forbearance 1,433,713 -51,831 650,257 -16,656 2,094,900 -68,635 Total (A) 56,281,019 -8,525,119 33,186,675 -1,565,536 135,842,388 -10,493,542 B. Off-balance-sheet exposures B.1 Impaired exposures 1,453,565 -76,961 18,349 -2,478 1,579,059 -80,028 B.2 Non-impaired exposures 43,541,480 -29,728 3,568,713 -7,919 55,597,092 -43,148 Total (B) 44,995,045 -106,689 3,587,062 -10,397 57,176,151 -123,176 Total (A+B) at 31 December 2018 101,276,064 -8,631,808 36,773,737 -1,575,933 193,018,539 -10,616,718 Total (A+B) at 31 December 2017 (*) 76,998,041 -11,058,209 30,890,139 -1,395,979 152,221,220 -12,917,911 (*) Values determined in compliance with accounting standard IAS 39, restated for comparative homogeneity

102 Time distribution by residual contract duration for financial assets and liabilities Over 3 Over 6 Over 1 day to Over 7 days Over 15 days Over 1 month Over 1 year Over Indeterminate ASSETS/VALUES Demand months to 6 months to 1 7 days to 15 days to 1 month to 3 months to 5 years 5 years duration months year A -Cash assets Government securities 107,488 0 0 0 152,021 127,315 1,693,572 10,472,698 14,665,679 0 Other debt securities 76,361 0 10,250 28,259 25,430 367,519 148,814 3,720,827 2,617,242 511 UCIT units 492,425 0 0 0 0 0 0 0 0 0 Loans: 30,427,743 235,191 703,453 1,425,110 3,325,034 5,142,818 6,632,516 30,782,122 30,837,051 759,185 - Banks 1,633,608 36,118 447,128 133,939 76,063 231,142 185,015 374,051 128,786 563,859 - Customers 28,794,135 199,073 256,325 1,291,171 3,248,971 4,911,676 6,447,501 30,408,071 30,708,265 195,326 Total (A) 31,104,017 235,191 713,703 1,453,369 3,502,485 5,637,652 8,474,902 44,975,647 48,119,972 759,696 B -Cash liabilities Deposits and current accounts -79,629,163 -496,013 -52,558 -250,435 -859,911 -483,370 -416,623 -57,312 0 0 - Banks -878,953 -126,760 -16,614 -10,507 -31,697 -10,026 -13,365 0 0 0 - Customers -78,750,210 -369,253 -35,944 -239,928 -828,214 -473,344 -403,258 -57,312 0 0 Debt securities -191,448 -1,669 -9,801 -410,846 -1,298,373 -411,263 -810,968 -12,871,487 -2,148,483 -104,900 Other liabilities -1,467,854 -2,838,023 -1,725,392 -2,638,866 -3,456,405 -2,278,799 -415,554 -23,808,482 -1,656,681 0 Total (B) -81,288,465 -3,335,705 -1,787,751 -3,300,147 -5,614,689 -3,173,432 -1,643,145 -36,737,281 -3,805,164 -104,900 C -Off-balance-sheet transactions Financial derivatives with exchange of equity -1,110 -4,769,611 -3,302,517 -7,079,230 -14,324,486 -7,738,332 -12,038,185 -463,221 -12,507 0 - Long positions -556 -2,389,150 -1,652,114 -3,547,451 -7,162,529 -3,883,956 -5,989,791 -151,750 -7,108 0 - Short positions -554 -2,380,461 -1,650,403 -3,531,779 -7,161,957 -3,854,376 -6,048,394 -311,471 -5,399 0 Financial derivatives without exchange of -4,247,186 0 0 0 -9,798 0 0 -191,689 -11,027 0 equity - Long positions -1,630,972 0 0 0 -9,798 0 0 -191,689 -11,027 0 - Short positions -2,616,214 0 0 0 0 0 0 0 0 0 Deposits and loans to receive 0 -6,928 0 0 0 0 0 0 0 0 - Long positions 0 -3,464 0 0 0 0 0 0 0 0 - Short positions 0 -3,464 0 0 0 0 0 0 0 0 Irrevocable commitments to disburse funds -71,954 -124,305 0 -17,741 -17,606 -981 0 -16,825 0 0 - Long positions 0 -71,954 0 -17,741 -17,205 -981 0 -16,825 0 0 - Short positions -71,954 -52,351 0 0 -401 0 0 0 0 0 Financial guarantees given -86,778 -258 -591 -3,786 -40,437 -76,709 -105,233 -247,987 -318,342 0 Financial guarantees received 0 0 0 0 0 0 0 0 0 0 Credit derivatives with exchange of equity 0 0 0 0 0 0 0 0 0 0 - Long positions 0 0 0 0 0 0 0 0 0 0 - Short positions 0 0 0 0 0 0 0 0 0 0 Credit derivatives without exchange of equity -857 0 0 0 0 0 0 0 0 0 - Long positions -857 0 0 0 0 0 0 0 0 0 - Short positions 0 0 0 0 0 0 0 0 0 0

103 Trend of total writedowns relative to cash exposures with customers

Default Unlikely to pay Impaired past due loans

(thousands of euros) of which: of which: of which: Total subject to Total subject to Total subject to forbearance forbearance forbearance

A. Initial total writedowns 9,955,233 794,796 2,967,654 1,669,660 14,969 3,351

- of which: exposures transferred but 77,520 481 4,726 1,416 786 14 not derecognised

B. Increases 3,780,976 633,024 1,313,749 652,889 18,469 2,626

B.1 writedowns on impaired financial 0 0 0 0 0 0 assets, acquired or originated

B.2 other writedowns 1,864,965 391,980 1,050,636 516,550 17,025 2,055

B.3 losses on sales 840,625 64,026 14,516 9,859 0 0 B.4 transfers from other categories of 407,950 174,250 7,223 3,145 832 7 impaired exposures

B.5 contractual changes without 0 0 1,842 1,842 0 0 derecognition

B.6 other increases 667,436 2,768 239,532 121,493 612 564

C. Decreases -6,552,132 -907,167 -1,377,652 -711,268 -14,569 -3,875

C.1 writebacks from valuation -461,669 -45,015 -479,343 -329,664 -4,284 -684

C.2 writebacks from collection -191,672 -12,862 -136,342 -91,314 -118 -14

C.3 gains on sales -563,676 -30,008 -34,012 -11,044 0 0

C.4 cancellations -1,890,800 -131,332 -123,616 -51,395 -479 -3

C.5 transfers to other categories of -871 0 -405,446 -173,246 -9,688 -3,174 impaired exposures

C.6 contractual changes without 0 0 0 0 0 0 derecognition

C.7 other decreases -3,443,444 -687,950 -198,893 -54,605 0 0

D. Final total writedowns 7,184,077 520,653 2,903,751 1,611,281 18,869 2,102

- of which: exposures transferred but 59,964 828 4,002 1,494 866 21 not derecognised

104 Trend of total writedowns relative to cash exposures with banks

Default Unlikely to pay Impaired past due loans

of which: of which: of which: Total subject to Total subject to Total subject to forbearance forbearance forbearance

A. Initial total writedowns 1,530 0 15,294 0 0 0

- of which: exposures transferred but 0 0 0 0 0 0 not derecognised

B. Increases 0 0 0 0 0 0

B.1 writedowns on impaired financial 0 0 0 0 0 0 assets, acquired or originated

B.2 other writedowns 0 0 0 0 0 0

B.3 losses on sales 0 0 0 0 0 0 B.4 transfers from other categories of 0 0 0 0 0 0 impaired exposures

B.5 contractual changes without 0 0 0 0 0 0 derecognition

B.6 other increases 0 0 0 0 0 0

C. Decreases -1,272 0 0 0 0 0

C.1 writebacks from valuation -17 0 0 0 0 0

C.2 writebacks from collection 0 0 0 0 0 0

C.3 gains on sales 0 0 0 0 0 0

C.4 cancellations -1,255 0 0 0 0 0

C.5 transfers to other categories of 0 0 0 0 0 0 impaired exposures

C.6 contractual changes without 0 0 0 0 0 0 derecognition

C.7 other decreases 0 0 0 0 0 0

D. Final total writedowns 258 0 15,294 0 0 0

- of which: exposures transferred but 0 0 0 0 0 0 not derecognised

105 EU CR1-A – Credit quality of exposures by class of exposure and type of instrument

Gross amounts of Expenses for Net amounts Specific write- Generic write- write-downs of Exposures in Exposures not in Write-offs downs of loans downs of loans loans in the (a+b-c-d-e) default status default status period 1 Central administrations or central banks ------2 Institutions ------3 Businesses: 11,767,124 67,730,790 5,892,594 199,848 5,170,621 73,405,473 4 Of which: Specialised loans ------5 Of which: SMEs 9,137,396 26,379,040 5,176,644 128,601 4,513,151 30,211,192 6 Retail: 3,476,752 54,620,477 1,734,396 169,553 1,624,498 56,193,280 7 Secured by real estate assets: 2,110,683 28,240,880 991,293 92,295 953,548 29,267,975 8 Of which: SMEs 756,409 4,724,344 294,335 38,682 279,210 5,147,737 9 Of which: Non-SME 1,354,274 23,516,535 696,958 53,613 674,338 24,120,238 10 Qualified revolving 6,066 1,009,111 1,677 3,381 1,633 1,010,118 11 Other retail: 1,360,003 25,370,487 741,426 73,876 669,317 25,915,187 12 Of which: SMEs 1,107,864 23,107,592 567,870 67,675 518,725 23,579,912 13 Of which: Non-SME 252,138 2,262,894 173,556 6,201 150,592 2,335,276 14 Equity instruments - - - - - 15 Securitisation positions - 1,437,869 - - 1,437,869 16 Total with IRB approach 15,243,876 123,789,136 7,626,989 369,400 6,795,118 131,036,623 17 Central administrations or central banks - 35,838,082 - 8,839 35,829,243 18 Regional administrations or local authorities - 775,309 - 142 775,167 19 Public bodies - 987,309 - 16,035 971,274 20 Multilateral development banks - - - - - 21 International organisations - 210,500 - - 210,500 22 Institutions - 37,465,814 - 9,944 37,455,870 23 Businesses: - 9,531,484 - 30,378 9,501,106 24 Of which: SMEs 6,517,032 24,272 6,492,759 25 Retail: - 2,274,154 - 11,865 2,262,290 26 Of which: SMEs 590,522 2,336 588,186 27 Secured by mortgages on properties: - 697,245 - 14 697,231 28 Of which: SMEs 438,727 - 1 438,726 29 Exposures in default status 3,969,839 - 2,022,692 - 1,142,743 1,947,147 30 Positions associated with a particularly high risk 679,508 475,813 309,754 970 - 844,596 31 Covered bonds - 101,819 - - 101,819 Loans to institutions and businesses with a short-term assessment 32 - - - - - of creditworthiness 33 Undertakings for collective investment - 1,802,052 - 5,766 1,796,285 34 Equity instruments 7,264 1,465,583 - 425 - 1,472,422 35 Other exposures - 5,037,750 - - 5,037,750 36 Securitisation positions - 101,206 - 365 100,841 37 Total with standardised approach 4,656,611 96,764,119 2,332,446 84,742 0 1,142,743 99,003,542 38 Total 19,900,487 220,553,255 9,959,435 454,142 0 7,937,861 230,040,165 39 Of which: Loans 12,018,023 100,693,685 5,198,854 375,382 1,541,958 107,137,472 40 Of which: Debt securities 142,554 32,102,668 97,137 18,566 2,044 32,129,519 41 Of which: Off-balance-sheet exposures 1,659,087 55,164,509 80,028 43,804 8,142 56,699,764

106 EU CR1-B – Credit quality of exposures by segment or type of counterparty

Gross amounts of Expenses for Net amounts Specific Generic Exposures write-downs Exposures in write-downs write-downs Write-offs not in default of loans in (a+b-c-d) default status of loans of loans status the period 1 Agriculture, silviculture and fishing 98,879 1,414,353 -27,718 -6,376 1,479,138 2 Mining 21,558 374,940 -4,022 -1,443 391,033 3 Manufacturing 1,807,517 17,143,103 -926,589 -40,829 17,983,202 4 Supply of electricity, gas, steam and air conditioning 71,556 1,126,308 -22,715 -3,185 1,171,964 5 Supply of water 54,472 582,201 -28,976 -3,104 604,593 6 Building 3,238,452 4,885,834 -1,312,673 -53,470 6,758,143 7 Wholesale and retail trading 649,124 8,679,245 -319,225 -26,242 8,982,902 8 Transport and storage 218,935 1,879,805 -75,517 -7,728 2,015,495 9 Hospitality and catering services 227,678 1,682,169 -97,553 -12,863 1,799,431 10 Information and communication 114,208 1,198,379 -37,201 -3,149 1,272,237 11 Financial and insurance businesses 44,744 286,951 -22,597 -1,410 307,688 12 Property 3,246,004 5,123,605 -1,385,433 -68,162 6,916,014 13 Professional, scientific and technical businesses 222,939 2,259,073 -116,284 -6,833 2,358,895 14 Administrative activities and support services 112,201 922,282 -70,360 -3,119 961,004 15 Public administration and defence, obligatory social insurance 3,392 3,970 -1,163 -4 6,195 16 Education 2,339 35,883 -1,172 -300 36,750 17 Health service and social assistance activities 23,581 644,714 -6,525 -1,741 660,029 18 Art, events and leisure 34,073 220,520 -14,024 -1,717 238,852 19 Other services 97,432 1,006,994 -44,918 -1,745 1,057,763 Total Exposures NON FINANCIAL Companies 20 10,289,084 49,470,329 -4,514,665 -243,420 -340,123 -1,229,851 55,001,328 (Sum of Lines 1 to 19) 21 Total Exposures Companies OTHER THAN NON-FINANCIAL 1,743,610 51,208,685 -684,189 -131,962 -51,301 -273,719 52,136,144 22 Total Exposures BALANCE-SHEET 12,032,694 100,679,014 -5,198,854 -375,382 -391,424 -1,503,570 107,137,472 23 Total exposures OFF-BALANCE-SHEET 1,659,087 55,164,509 -80,028 -43,804 0 7,992 56,699,764

107 EU CR1-D – Distribution of exposures of past-due bands *

Gross amounts:

> 30 days ≤ > 90 days ≤ > 180 days ≤ > 1 year ≤ 5 ≤ 30 days > 5 years 90 days 180 days 1 year years

Debt instruments at cost 116,553,351 4,174,162 399,120 937,952 4,866,326 2,468,937 or amortised cost

Debt instruments at fair value subject to value 14,864,240 0 0 0 0 0 reductions

Debt instruments at LOCOM or fair value not 367,608 248,401 12,700 3,045 60,812 276 subject to writedowns

Total exposures 131,785,199 4,422,563 411,820 940,997 4,927,138 2,469,213

* The structure of the table has been adjusted in order to incorporate the changes introduced by the new accounting standard IFRS 9.

EU CR1-E – Impaired and forborne exposures *

Gross amount of non-impaired and impaired exposures

Of which non- Of which impaired Of which impaired but Of which forborne Of which past-due > 30 written Of which non- in default days and ≤ 90 down forborne impaired status days (impaired)

Debt instruments at cost 129,399,848 995,130 2,059,325 11,851,367 11,836,696 11,851,367 4,907,819 or amortised cost

Debt instruments at fair value subject to 14,864,240 0 0 0 0 0 0 writedowns

Debt instruments at LOCOM or fair value not 692,842 1,353 103,940 323,881 323,881 175,567 subject to writedowns

Off-balance-sheet 56,823,596 112,389 1,659,087 1,659,087 165,220 exposures

Accumulated impairment losses or accumulated fair value Real and financial changes due to credit risk and provisions guarantees received On non-impaired exposures On impaired exposures On Of which Of which Of which impaired forborne forborne forborne exposures exposures Debt instruments at cost or -384,436 -68,621 -5,111,453 -1,710,129 5,172,187 4,291,163 amortised cost

Debt instruments at fair value -9,512 0 0 0 0 0 subject to writedowns

Debt instruments at LOCOM or fair value not subject to -184,538 -86,235 57,969 112,288 writedowns Off-balance-sheet exposures -43,804 -462 -80,028 0 344,740 103,641

* The structure of the table has been adjusted in order to incorporate the changes introduced by the new accounting standard IFRS 9.

108 EU CR2-A - Changes in generic and specific write-downs of loans *

Write-downs with Write-downs without increase in credit risk Write-downs for increase in credit risk after initial impaired debt after initial recognition, but not instruments (Stage 3) recognition (Stage 1) impaired (Stage 2)

Initial balance 83,010 182,325 10,421,341

Changes due to variations in credit risk (net) 8,204 -17,884 1,549,363

Changes due to updating the estimation 0 0 0 method (net)

Increases due to adjustments at the 0 0 0 disbursement/issue/acquisition stage

Decreases due to extinguishment or redemption 0 0 -2,969,358 Decreases due to write-offs 0 0 -1,852,078 Impact of exchange rate differences 0 0 0

Business combinations, including acquisitions 43,954 94,660 3,130,057 and disposals of affiliates

Other adjustments -308 -404 -5,168,130 Final balance 134,860 258,697 5,111,195

Recoveries from collection on assets previously 19,458 written off Write-offs recognised directly through profit or -160,774 loss * The structure of the table has been adjusted in order to incorporate the changes introduced by the new accounting standard IFRS 9.

EU CR2-B – Changes in loans and debt securities impaired and in default status

Gross amount of exposures in default status

Initial balance 25,580,999

Loans and debt securities in default status or impaired since last reporting period 1,766,884

Returned to current status -1,052,174 Amounts written off -2,014,895 Other changes -5,964,101 Final balance 18,316,713

109 EU CRB-B – Total and average value of net exposures

Net value of exposures Average net exposures at end of period during the period

Central administrations or central banks - - Institutions - - Businesses 73,405,473 69,479,258 - Specialised loans - - - SMEs 30,211,192 30,602,503 - Other businesses 43,194,281 38,876,755 Retail 56,193,281 51,114,646 - Secured by real estate assets 29,267,975 27,304,138 - SMEs 5,147,737 5,030,857 - Non-SME 24,120,238 22,273,281 - Qualified revolving 1,010,118 951,946 - Other retail 25,915,188 22,858,562 - SMEs 23,579,912 20,724,201 - Non-SME 2,335,276 2,134,361 Equity instruments - Securitisation positions 1,437,869 1,192,938 Total with IRB approach 131,036,623 121,786,842 Central administrations or central banks 35,829,243 35,816,856 Regional administrations or local authorities 775,167 798,284 Public bodies 971,274 943,578 Multilateral development banks - 19,964 International organisations 210,500 52,625 Institutions 37,455,870 34,691,717 Businesses 9,501,106 14,762,697 - SMEs 6,492,759 7,925,930 Retail 2,262,290 4,067,963 - SMEs 588,186 2,097,957 Secured by mortgages on properties 697,231 3,059,008 - SMEs 438,726 665,775 Exposures in default status 1,947,147 3,104,531 Positions associated with a particularly high risk 844,596 702,033 Covered bonds 101,819 98,031 Loans to institutions and businesses with a short-term assessment - - of creditworthiness Undertakings for collective investment 1,796,285 2,447,097 Equity instruments 1,472,422 1,497,393 Other exposures 5,037,750 4,561,898 Securitisation positions 100,841 200,868 Total with standardised approach 99,003,541 106,824,544 Total 230,040,164 228,611,386

110 EU CRB-D – Concentration of exposures by segment or type of counterparty

l t e e e , i c s r r n r i r y f g

i a d i u e o u o t l

i t s i t t r s s a l n t e d a i n l p s s r , a g e d e c n e i e i u r n d c a a e t o a p r e e l o e n n i c d g e r v i c i t i t i c n s n t a t n g r i a u n c c t c e d s n n a e i i s i v y s o i s c c s d

e i a a v a n g o u r s t

s r l n i n i n s c a v w t l g a g n s c e t i r l n i y e n e i r n t r d n c s l e u s i s t , d e e h i i f o i t t a h n n n i l y v a c e i i s i o i a f l c a n s e a s s r i i r t , e e b i t i n h

n i m o d c v s t a s

a m a f n l p t e d i i s e a c a i i v r f c o e e n o f g l u a n a t i t r a t e r t r e n i s a y o d i T d a t u d l u t s u n o O u n r d a

s c n r r l i e M e e u c s o a m m a p n B s t r i u t d t m n p a h P s n r l y e e o d h s a a s d n n t s l i g i E i l e t o e i n b p s d a m l t o c v a l u i n t n , p o i i a f p c l c a u s s F r e o o e A O c v b a H a a M i f i n p S o b e n I u r , a h t c o s c t s o u u H a r r g c g S r n W P i P T a A A

Businesses 2,330,209 1,001,392 27,034,847 3,045,418 812,535 7,187,429 10,524,132 2,521,096 1,586,418 2,150,437 810,136 5,435,581 4,298,801 1,188,818 6,980 23,121 868,534 301,681 157,259 2,120,650 73,405,473

Retail 1,764,839 84,237 9,670,505 87,364 252,630 3,243,108 6,908,522 1,032,954 1,127,125 543,070 96,196 1,510,449 1,020,649 578,540 215 62,133 223,407 146,135 282,424 27,558,779 56,193,280

Securitisation ------2,955 ------1,434,914 1,437,869 positions Total with IRB 4,095,048 1,085,629 36,705,352 3,132,781 1,065,165 10,430,537 17,432,654 3,554,050 2,713,543 2,693,506 909,287 6,946,030 5,319,449 1,767,359 7,196 85,254 1,091,941 447,816 439,683 31,114,343 131,036,623 approach Central administrations ------1,388 - - - 387 - - - - 35,827,468 35,829,243 or central banks Regional administrations ------396 ------55,127 - - - - 719,645 775,167 or local authorities

Public bodies - - - 17,978 5,019 6,183 - 10,009 - 135,056 34,251 - - 12,386 46,846 - 90,374 - 16 613,157 971,274

Multilateral development ------banks International ------210,500 210,500 organisations

Institutions ------22,984,985 180 - 203 - - - - - 14,470,502 37,455,870

Businesses 41,473 6,464 346,536 321,693 96,707 788,447 96,364 198,892 129,750 8,387 872,291 768,109 367,286 163,145 1,192 3,538 26,183 21,078 158,472 5,085,098 9,501,106

Retail 8,779 60 28,073 20,008 1,754 29,017 41,108 6,253 13,983 6,417 1,279 102,843 15,896 20,691 2 1,906 5,630 5,987 1,431,979 520,626 2,262,290

Secured by mortgages on 4,438 - 134,313 4,725 2,346 28,286 57,014 22,938 21,200 6,163 3,658 84,714 15,931 9,173 - 427 11,508 857 3,581 285,961 697,231 properties Exposures in 3,497 2,583 172,532 10,582 2,366 348,260 102,369 67,368 34,847 15,653 31,941 880,982 8,758 30,414 37 97 5,900 13,777 1,771 213,413 1,947,147 default status Positions associated with - - 14 - - 410,172 - 330 4,148 - 2,069 63,907 1,047 - - 30 - - 67 362,812 844,596 a particularly high risk

Covered bonds ------101,819 101,819

Undertakings for collective ------1,796,285 1,796,285 investment Equity 16,554 - 503 - - 217 0 54,996 1,000 95,155 84,259 2,945 45,528 6,338 341 - 6,630 0 - 1,157,955 1,472,422 instruments

Other exposures - - 12 - - 692 - - - - 840,723 - 2,500 ------4,193,823 5,037,750

Securitisation ------100,841 100,841 positions Total with standardised 74,740 9,107 681,983 374,987 108,191 1,611,274 297,250 360,786 204,929 266,831 24,856,842 1,903,679 456,947 242,349 103,932 5,998 146,224 41,699 1,595,888 65,659,905 99,003,542 approach

Total 4,169,788 1,094,736 37,387,335 3,507,768 1,173,356 12,041,811 17,729,905 3,914,836 2,918,471 2,960,337 25,766,129 8,849,709 5,776,396 2,009,708 111,128 91,252 1,238,165 489,515 2,035,571 96,774,248 230,040,164

111 EU CRB-E – Duration of exposures

Net value of exposure

No > 1 year On request <= 1 year > 5 years established Total <= 5 years duration

Businesses 30,414,947 12,772,200 17,051,640 11,685,751 1,480,935 73,405,473 Retail 18,407,898 3,625,439 6,107,314 27,531,382 521,248 56,193,280

Securitisation positions 0 - - 1,437,869 - 1,437,869

Total with IRB approach 48,822,845 16,397,639 23,158,954 40,655,002 2,002,182 131,036,623

Central administrations or central 34,781,463 548,565 100,816 351,610 46,790 35,829,243 banks

Regional administrations or local 592,868 54,847 35,952 91,377 124 775,167 authorities

Public bodies 553,467 114,390 78,042 225,374 1 971,274 International organisations 210,500 - - - - 210,500 Institutions 9,040,436 24,932,982 1,427,695 2,054,040 716 37,455,870 Businesses 3,430,958 1,786,741 1,686,748 2,517,762 78,896 9,501,106 Retail 444,074 67,119 215,076 1,535,203 818 2,262,290

Secured by mortgages on 3,022 13,875 213,960 466,375 - 697,231 properties

Exposures in default status 66,724 171,306 213,068 538,416 957,634 1,947,147

Positions associated with a 204,859 96,252 216,323 181,492 145,670 844,596 particularly high risk

Covered bonds 0 - - 101,819 - 101,819

Undertakings for collective 474,511 644,489 439,026 238,259 - 1,796,285 investment

Equity instruments 0 37,232 96,470 50,651 1,288,069 1,472,422 Other exposures 2,313,399 - - - 2,724,351 5,037,750

Securitisation positions 0 - - 100,841 - 100,841

Total with standardised approach 52,116,283 28,467,797 4,723,177 8,453,217 5,243,068 99,003,542

Total 100,939,128 44,865,436 27,882,131 49,108,219 7,245,250 230,040,164

112 Credit Risk - standard approach

Process of assessing creditworthiness

Credit risk – standardised approach List of ECAIs (External Credit Assessment Institutions) and ECAs (Export Credit Agencies) used in the standardised approach and of the portfolios in which their ratings are applied.

Characteristics of the Ratings Portfolios ECA/ECAI (solicited/unsolicited)

Moody’s Exposures to Central Administrations and Standard & Poor’s Solicited Central Banks Fitch Moody’s Exposures to International Organisations Standard & Poor’s Solicited Fitch Moody’s Exposures to multilateral development Standard & Poor’s Solicited banks Fitch Moody’s Standard & Poor’s Solicited Exposures to businesses and other Subjects Fitch Cerved Unsolicited Moody’s Exposures to undertakings for collective Standard & Poor’s Solicited investment in transferable securities (UCITS) Fitch

Securitisations

Portfolios ECA/ECAI Moody’s Standard & Poor’s Positions related to securitisations with short-term rating Fitch Scope DBRS Moody’s Standard & Poor’s Positions related to securitisations other than those with short-term Fitch rating Scope DBRS

113 The process for assessing the issuer's creditworthiness requires linking the identification information provided by external providers to all counterparties for which it is available, irrespective of the presence and type of business present in the banking book (for example exposures in banking book securities, mortgage loans, etc.).

The process for assessing the creditworthiness of an issue provided by external providers requires that it be historicised in specific systems, irrespective of the nature of the security. This information is subsequently used for reports by linking the information using an internal identification code.

With reference to the association of the external rating of each ECAI or export credit agency chosen to the creditworthiness classes, the mapping used is provided by Implementing Regulation (EU) 2016/1799 of the European Commission.

EU CR4 – Standardised approach – Exposure to credit risk and effects of the CRM Exposures before CCF and Exposures after CCF and RWAs and RWA densities CRM CRM On- Off- On- Off- balance- balance- balance- balance- RWA Exposure classes RWAs sheet sheet sheet sheet densities amount amount amount amount Central administrations or central 32,873,014 2,944,966 35,762,070 2,920,727 3,652,656 9.44% banks Regional administrations or local 263,490 507,440 330,875 4,103 66,669 19.90% authorities Public bodies 389,901 581,367 388,739 84,529 365,702 77.27% Multilateral development banks 0 0 115,445 3,198 0 0.00% International organisations 0 210,500 0 0 0 0.00% Institutions 9,433,434 3,999,037 9,302,262 545,121 4,191,162 42.56% Businesses 6,036,679 3,164,802 6,201,397 834,222 6,736,327 95.75% Retail 2,027,756 234,130 2,003,126 42,647 1,486,899 72.68% Secured by mortgages on 673,251 23,981 672,827 11,947 299,406 43.72% properties Exposures in default status 1,893,491 53,114 1,875,755 22,612 2,085,878 109.88%

Positions associated with a 726,845 117,751 726,390 56,508 1,174,348 150.00% particularly high risk

Covered bonds 101,819 0 101,819 0 19,481 19.13%

Loans to institutions and businesses with a short-term assessment of 0 0 0 0 0 0.00% creditworthiness Undertakings for collective 1,035,780 271,777 1,032,332 63,558 1,095,890 100.00% investment Equity instruments 1,443,276 0 1,443,276 0 2,368,936 164.14% Other positions 5,037,750 0 5,037,750 0 4,112,615 81.64% Securitisation positions 100,841 0 66,165 0 57,438 86.81% Total 62,037,327 12,108,865 65,060,227 4,589,174 27,713,406 39.79%

114 EU CR5 – Standardised approach

Risk weighting factors Exposure classes Total 0% 2% 4% 10% 20% 35% 50% 70% 75% 100% 150% 250% 370% 1250% Other Deducted Central administrations 35,639,700 0 0 0 1 0 6,063 0 0 2,628,612 0 408,422 0 0 0 379,052 38,682,798 or central banks Regional administrations 0 0 0 0 334,978 0 0 0 0 0 0 0 0 0 0 334,978 or local authorities Public bodies 0 0 0 0 123,153 0 17,978 0 0 332,136 0 0 0 0 0 473,268 Multilateral 118,643 0 0 0 0 0 0 0 0 0 0 0 0 0 0 118,643 development banks International 0 0 organisations Institutions 0 588,774 189,482 0 3,686,092 0 3,986,889 0 0 1,298,344 97,802 0 0 0 0 9,847,383

Businesses 0 0 0 0 17,015 0 730,309 0 0 6,102,585 185,712 0 0 0 0 7,035,619

Retail 0 0 0 0 0 0 0 0 2,045,774 0 0 0 0 0 0 2,045,774 Secured by mortgages 0 0 0 0 0 152,448 532,326 0 0 0 0 0 0 0 0 684,774 on properties Exposures in default 0 0 0 0 0 0 0 0 0 1,523,346 375,021 0 0 0 0 1,898,367 status Positions associated with 0 0 0 0 0 0 0 0 0 0 782,898 0 0 0 0 782,898 a particularly high risk Covered bonds 0 0 0 8,827 92,993 0 0 0 0 0 0 0 0 0 0 101,819 Loans to institutions and businesses with a short- 0 term assessment of creditworthiness Undertakings for 0 0 0 0 0 0 0 0 0 1,095,890 0 0 0 0 0 1,095,890 collective investment Equity instruments 0 0 0 0 0 0 0 0 0 826,170 0 617,106 0 0 0 1,212,821 1,443,276

Other positions 923,770 0 0 0 1,705 0 0 0 0 4,112,274 0 0 0 0 0 5,037,750

Securitisation positions 17,564 0 0 37,314 0 54,878

Total 36,682,113 588,774 189,482 8,827 4,273,501 152,448 5,273,564 0 2,045,774 17,919,356 1,441,433 1,025,528 0 37,314 0 1,591,872 69,638,114

The exposures detailed in the “Deducted” column do not contribute to the total of risk-weighted assets as with the presentation of the Corep schemes for credit risk.

Additionally, we must specify that the estimate of risk-weighted assets inferable from an analysis of the data shown in the present table is different from the actual final amount of RWAs published in Table CR4 because it does not consider the SME supporting factor provided for in Art. 501 of the CRR Regulation in the cases and with the limits applicable.

115 Credit Risk - IRB approach

Authorisation by the Supervisory Authority and scope of application The former Banco Popolare Group obtained authorisation from the Bank of Italy to use internal models (original validation on 18 May 2012) according to the A-IRB (Advanced Internal Rating Based model) approach for the purpose of calculating the capital requirement on credit risk. Following the merger operation between the former Banco Popolare Group and the former BPM Group, the European Supervisory Authority agreed to the use of internal models at the time validated on the former Banco Popolare perimeter on the same basis of the new Banco BPM Group for the purpose of calculating the capital requirements until 31-12-2017.

Following the acceptance of the model change application made by the former Banco Popolare in May 2015, the ECB authorised the Group to make the model changes requested incorporating a series of temporary prudential measures into the calculation of non-performing RWAs, of non-performing expected losses and on the retail EAD. These measures would have expired after authorisation to use the new A-IRB models for retail EAD, LGD defaulted assets and ELBE. Starting from the reporting of 31-03-2017, and for the whole of 2017, the following prudential measures (add-ons) were therefore made operational:

 application of a credit conversion factor of 100% for IRB Retail exposures:  calculation of non-performing IRB RWA through application of a regulatory formula  obligation of a floor for non-performing expected loss corresponding to 45% of gross exposures.

In this context, it must be specified that, in May 2017, an application for model change and authorisation to extend the A-IRB models to the combined Banco BPM portfolio was sent to the ECB, which included the new EAD retail, LGD defaulted assets and ELBE models.

Following the ECB inspection process, on 16-02-2018, the Group received authorisation to adopt its internal risk management systems with extension to BPM S.p.A. The authorisation is effective starting from the reporting of 31 March 2018.

The validation perimeter at 31-12-2018 consists of the assets attributable to the regulatory classes “loan exposures to businesses” and “loan exposures to retail” (acceptance and monitoring models) of the companies of the former Banco Popolare Group, widened to the perimeter of BPM S.p.A, starting from the reporting of 31-03-2018.

More specifically, authorisation was requested and obtained for the use of five rating models, aimed at estimating D (default probability) respectively of the counterparties segmented with the Large Corporate, Mid Corporate Plus, Mid Corporate, Small Business and Private rating models and of two LGD (Loss Given Default ELBE and Defaulted Asset) models, aimed at estimating the loss in the case of default respectively of Business and Private counterparties and the EAD model relative solely to the Retail portfolio.

116 AIRB and standard exposures for the Banco BPM Group At 31/12/2018, the EAD for the Banco BPM Group totalled € 168.8 billion, of which 72.4 processed using a standardised approach and 96.4 with the AIRB approach. Three sub- systems can be identified within the standardised area:

- “Roll-Out”, exposures subject to the progressive extension of the AIRB approach;

- “PPU”, those destined for partial permanent use of the standardised approach

- “Other", exposures in other assets, DTA, significant equity investments in entities in the financial sector.

Below are EAD amounts at the reporting date:

EAD Perimeter % € billion AIRB 96.4 57.1%

Standard 72.4 42.9%

Roll-Out 4.5 2.7%

PPU 59.3 35.1%

Other 8.7 5.1%

Total 168.8 100.0%

Details of Roll-Out perimeter The perimeter classified as Roll-Out includes the following types:

- ProFamily corporate and retail exposures (1.5 billion);

- specialised loans (2.4 billion);

- speculative real estate, RED (592 million). The Roll-Out plan also includes, within the IRB perimeter, application of the EAD model to the Corporate Performing portfolio (2019).

Illustration of the structure, use, management processes and control mechanisms of the internal rating systems

Structure of the internal rating systems (PD) The rating models involved in the validation are intended to respond to a precise rationale, that of obtaining, for both reporting and management purposes, risk measures:

 capable of incorporating the fundamental drivers underlying creditworthiness of parties in relation to which the Group has or intends to assume loan exposures;

 relatively stable over time, so as to reflect, in each customer segment, the long-term expected riskiness of the Group’s current and potential loan exposures;

 capable of preventing phenomena of uncontrolled growth of risk in positive cycle periods and, on the contrary, of indiscriminate restriction of loans in those of 117 negative cycle (counter-cyclicity).

In light of these objectives, advanced statistical techniques were used in the various stages of the estimation process (e.g. Identification of the explanatory/predictive variables of default, integration of the scores, etc.) as well as calibration of the internal ratings.

The rating models were developed internally under the responsibility of the Risk Models structure.

The various stages of development of the models were structured to provide for the active involvement—in order to facilitate consistency of the models with management practices— of all internal stakeholders, namely the Loans Unit, the Organisation Unit, the Retail and Corporate Commercial Units, the Administration and Financial Statements Unit and the Group's Service Management (IT) Company (hereinafter Information Technology).

In the process of developing the models, statistical techniques were used to support the methodological choices with solid empirical evidence. In particular, the interpretability and economic-financial value of the indicators used in the context of the rating models were the subject of verification by the Risks Unit during the estimation activity (i.e. economic as well as statistical significance of the indicators) and discussions in the context of the planning Workgroup (i.e. Loans, Internal Validation, Internal Audit Units).

The statistical significance of the information was ascertained through appropriate analyses, which led to successive selections of the most significant indicators. This approach enabled the identification of the most significant information, avoiding the inclusion of redundant or superfluous information which would have increased its complexity, with no effective added value in terms of accuracy of the estimates produced.

The set of information used to estimate the rating models was defined with the objective of making the best use of the whole available database and was developed on the basis of the experience gained on the rating models previously estimated and of consistency with loan management practices, verified through the active collaboration of the competent corporate units.

In particular, the historical series used in the estimation stage feature the greatest time depth available, and the development samples were selected to ensure the highest representativeness with respect to the Group’s loan portfolio.

Structure of the internal rating systems (LGD) The internal models for calculating Loss Given Default (LGD) were developed with the objective of prioritising—in identifying the explanatory drivers of the estimates—consistency with the Group’s lending processes.

The existing models at 31-12-2018 are differentiated by exposure bands, type of technical macro-form, presence/absence of guarantee, administrative status of the counterparty (performing, past due, probable defaults and bad) and vintage for defaults.

These were estimated by analysing the losses suffered by the Group on historic defaults ( LGD workout), with a definition of default consistent with that applied to PD estimation models. 118 In order to include the impacts deriving from recessive short-term periods in the LGD calculation structure, the downturn component is estimated on the basis of the type of portfolio being analysed.

Additionally, the model includes the estimate of indirect costs, that is administrative costs which are not directly attributable to the single procedure.

The new LGD defaulted asset models also make it possible, through a bootstrapping approach with opportune identification of an extreme percentile of the distribution of the LGD averages, to identify unexpected values of losses (or LGD DA), the difference of which from the best estimate of LGD (or LGD ELBE) makes it possible to calculate (by using a specific regulatory formula) the Risk Weighted Assets on defaults.

The Banco BPM Group updated the historical series underlying the estimate of the risk parameter in question in order to incorporate the most recent evolutions of the economic cycle.

Use of the rating system for management purposes The main characteristics of the rating system used in the process of granting, monitoring and managing loans, in pricing, in corporate governance and in reporting are described briefly below.

Granting Loans The rating plays a central role in assessing creditworthiness at the time of granting and revising/modifying credit.

The rating is used:

 for the purpose of identifying the decision-making powers, for which:

. the assessment of creditworthiness—expressed by the rating determined by the models developed for the various regulatory segments of customers—is attributed operationally to “Classes of decision-making competence”;

. the riskiness of the operations is measured using mitigation classes defined based on the LGD associated with each credit line;

 at the moment of closing the proposal and the related decision, when the proponent and the decision maker must express an opinion on the overall consistency between the fiduciary arrangement being proposed/decided on (type of credit lines and ancillary guarantees) and the assessment of creditworthiness expressed by the rating.

The Parent Company’s Credit Unit defines the credit policy guidelines, taking into account the economic and geo-sectoral information acquired from external sources in relation to the default probability and the expected losses of the various economic sectors.

The distribution of the growth of lending volumes is divided into the various sectors based on the values of the above metrics, providing for power reservations for counterparties with higher rating levels.

119 Loan Monitoring and Management Positions that show the first symptoms of negativity are automatically placed in a monitoring and management process. These positions are identified automatically once a month based on a series of indicators, including the rating.

The positions of each segment that present the worst ratings classes are intercepted and placed into the process. In addition, for each position included in the process, the Manager must analyse the consistency of the rating with the management class proposed and assess, case by case, any need to activate the process to change (override) the rating.

Pricing The Group has a pricing determination corrected for credit risk; this tool is capable of quantifying the minimum spread with respect to the internal rate of transfer of the funds which the company must carry out to ensure coverage of the expected loss, of the cost of capital and of all the components which enable value generation.

Corporate governance The system of internal models is used as input to the portfolio model for the estimate of economic capital against the credit risk of performing exposures, in the context of updating the risk propensity and of monitoring the risk limits (using Second Pillar economic capital metrics), both on a final-figure basis and on a prospective basis.

Reporting The rating and the LGD are the foundation of the management and operational reporting on the risks of the loan portfolio. As regards the management reporting, the Risks Unit periodically prepares the Tableau de Board of the Risks, which provides an overview of the Group’s risk position with reference to the set of all risk factors, according to an arrangement compliant with Basel 3 (Pillar I and Pillar II).

Calculation of collective impairment losses on performing positions For calculating the collective impairment losses, the Banco BPM Group, starting from 01-01- 2018, adopts, , the new accounting standard IFRS 96. The main innovation introduced consists of calculating lifetime expected losses for all positions which, with respect to the origination date (that is the date on which the account was opened), have presented a SICR—significant increase in credit risk. The assessment of the SICR of a position is based on quantitative criteria which use the lifetime default probabilities. To detect any worsening of creditworthiness which is not detected by the application of a statistical model, the assessment is then supplemented by qualitative risk indicators. This means that, for these positions, it is necessary to estimate the expected losses which can occur for the duration of the relationship until expiry (and not only for the first year of life, as required by the previous accounting standard IAS 39). In turn, this need requires the development of new models

6 In July 2014, the International Accounting Standard Board (IASB) issued the final version of IFRS 9 Financial Instruments, the new accounting standard that deals with the stages of recognition and measurement of financial assets and calculation of provisions. 120 which, starting from the internal models already implemented by the Bank (in accordance with Basel 3), make it possible to estimate in a forward-looking manner all the credit risk parameters which combine in the measurement of the expected losses.

In particular, Banco BPM estimates the lifetime expected losses using a combination of the following parameters:

 Default Probability (PD);

 Loss Given Default (LGD);

 Exposure at Default (EAD).

In order to observe the new accounting standard for calculation of expected losses, the parameters of PD, LGD and EAD must be:

 Point in Time: the models used must reflect the macroeconomic conditions in being at the reporting date;

 Forward-looking: the risk parameters must, where possible, incorporate the available future macroeconomic information;

 Lifetime: to be able to measure the expected losses of positions which have suffered a significant increase in credit risk with respect to origination, it is necessary estimate the parameters for the entire life of an instrument.

In general, the estimate of the lifetime expected losses can be summarised by the following formula:

where:

 T represents the expiry date of the operation;

 represents the discount factor (e.g. effective interest rate [EIR]);

 represents the effective exposure at time t, calculated as the sum of the future cash flows discounted at the interest rate;

 represents the marginal default probability between tempo t e t+1 calculated as the difference between the accumulated PD at time t+1 and the accumulated PD at time t;

 represents the loss given default to be applied at the instant t.

Calculation of the impairment loss with statistical procedure on positions in default (ELBE) For the purpose of accounting measurement of impaired loan portfolios subject to statistical valuation procedures, the Banco BPM Group decided to adopt the ELBE parameter— appropriately modified with respect to its prudential version—for the accounting 121 measurement of the following perimeter of loan exposures:

 In Default and Unlikely to Pay (UtP) of a nominal amount, at the measurement date, of less than € 300 k;

 Defaulted past due exposures irrespective of the nominal amount.

The Banco BPM Group decided to adopt the procedure in question gradually. The following set of rules was therefore established in the launch stage of the new impaired loan measurement system for the 2017 financial statements:

 Exposures that already fell within the perimeter of measurement on a statistical basis in the two former banks (Defaulted Past Due Exposures, UtP and In Default former BP ≤ 100 k and UtP and In Default former BPM ≤ 200 k) were made immediately subject to measurement through the ELBE parameter;

 for exposures classified as UtP and In Default included in the € 100k-300k amount band if coming from the former BP and in the € 200k-300k amount band if coming from the former BPM, the new rule is applied (measurement through ELBE) starting from 1.10.2017, for new entries and for all files for which the expiry date of the last revision had already been reached/passed at 31.12.2017;

 for exposures classified as UtP and In Default included in the € 100k-300k amount band if coming from the former BP and in the € 200k-300k amount band if coming from the former BPM, the existing analytical measurement is maintained (subject to any override by the competent manager if there is new valid information of which the latter has come into possession), if the latter is still valid (that is the revision expiry date has still not been reached at 31.12.2017).

With reference to non-performing positions not including in the perimeters described above, analytical measurement was maintained.

Process of management and recognition of the techniques for attenuating credit risks The Banco BPM Group pays attention to the acquisition of loan collaterals and securities, i.e. the use of tools and techniques that facilitate the mitigation of credit risk. On this point, in the performance of lending activities by the Group Banks, the acquisition of the guarantees typical of the banking business is widespread; these are, mainly, real guarantees on properties or financial instruments and personal sureties given by private individuals, businesses, financial institutions, etc.

Within the Basel Project, and in particular in the CRM project area—which saw the transversal contribution of resources of the Risks, Organisation and Information Systems units—all the actions of a methodological, organisational and procedural kind were carried out in order to enable the use of risk mitigation techniques based on internal default probability (PD) and loss given default (LGD) models, in line with the legislative requirements.

With particular reference to management of the various types of real and personal 122 guarantees, there are:

 IT procedures that cover all the aspects related to management of the aforementioned guarantees;

 Internal rules (Circulars, Instructions, Regulations, Process Standards) for the use of all the Organisational Structures involved (Network and Central Structures), which provide indications of both a normative and a technical-operational nature.

The compliance of these actions with the legislative requirements was subjected to verification by the internal validation and audit units.

Control and revision of the rating systems A prerequisite for the adoption of internal risk measurement systems for calculating the capital requirement is the presence of a process of validation and internal auditing of the rating systems, both at the stage of setting up these systems, aimed at obtaining authorisation from the Supervisory Authorities, and at the stage of continual management/maintenance of the same once authorisation has been obtained.

The Banco BPM Group has an internal Validation unit (part of the staff of the Risks unit) responsible for the validation processes of the Banco BPM Group’s risk measurement and management systems. These activities are carried out independently by the Units tasked with risk measurement and management and by the Unit responsible for Internal Auditing.

The structure is responsible for continual and iterative validation activity related to the risk measurement and management systems, in order to assess their adequacy with respect to the legislative requirements, the corporate operating needs and those of the market of reference.

The Internal Audit activity provided for in the Supervisory Regulations is carried out by Banco BPM’s Audit unit. With specific regard to credit risks, the structure audits the entire process of adoption and management of the internal measurement systems according to methods and areas of responsibility defined by the corporate regulations and on the basis of a specific work plan.

The structure is tasked with assessing the functionality of the overall arrangement of the process of measuring, managing and controlling the Group’s exposure to credit risks, also through periodic audits of the process of internal validation of the related models prepared under the terms of the Prudential Supervisory regulations.

Description of the internal rating models for the regulatory Corporate and Private segments (valid at 31-12-2018)

Aspects common to the various models Calibration of the model is based on a long-term central tendency. The calibration function was created to define a correspondence between integrated scores and the long-term default probabilities (PDs).

123 The calibration philosophy adopted by the former Banco is based on a logic of a through- the-cycle (TTC) type, which neutralises the possible impacts deriving from the presence of an economic cycle in the stage of expansion or recession.

The PD models return valuations divided into 11 performing rating classes, with average class PDs differentiated for each rating model.

Additionally, the Group has defined a methodological approach, on the basis of which the counterparty’s rating undergoes notching to consider whether the counterparty belongs to an Economic Group (only legal links between parent company and subsidiary are considered).

Large Corporate model The Large Corporate rating model was defined taking into account the classification of customers provided by the Credit Department experts (expert rank ordering). The objective of this decision was to obtain an assessment of the counterparty, which on the one hand would be based on statistical principles, and on the other would incorporate the specialist experience of the Credit Unit on this customer segment.

This model is made up of two modules: economic-financial and qualitative.

The score obtained from the qualitative module intervenes by notching (positive, negative or neutral) the rating class deriving from the economic-financial score.

The counterparty's rating can subsequently be changed for companies belonging to an economic group.

Finally, the Rating Desk and Performance structure attributes the final rating through a review of the rating assigned by the model based on warning signals or other information related to performance, available but not captured directly by the model.

Business Models The models related to Small Business, Mid Corporate and Mid Corporate Plus segmented counterparties are developed starting from four information sources processed in specific modules that contribute, through statistical scores, to determining the final Default Probability(PD) for each individual counterparty, through the adoption of integration functions differentiated by segment and by seniority of customers (acceptance portfolio and monitoring portfolio).

The elementary modules on which these models are based, corresponding to the four information sources, are the following:

 Internal Performance module: the purpose of this is to detect the trend of creditworthiness of trusted counterparties over time, and it is based on data concerning relations of the said counterparties with the banks in the Group;

 Central Credit Register module: the purpose of this is to detect the evolution over time of the counterparty's relationship (if reported) with the other banks of the system, based on the reporting data of the Central Credit Register;

124  Economic-Financial module: the purpose of this is to assess the creditworthiness of customers based on economic-financial information, with particular reference to counterparties that prepare financial statements according to the provisions of the Civil Code (or ordinary accounting);

 Qualitative module: this is based on information coming from qualitative questionnaires, divided into the counterparties' business activity segments.

Starting from the single scores of the modules, an integrated score is statistically calculated(integration function) to summarise in a single risk indicator the results coming from the elementary modules (Internal Performance, Central Credit Register and Economic- Financial for the monitoring model; Central Credit Register, Economic-Financial and Qualitative for the acceptance model).

The score produced by the integration function is subsequently associated with a default probability (PD) through the definition and application of a specific calibration function; this probability of default is, finally, mapped on the rating classes. The calibration functions, differentiated for each rating segment, have the objective of anchoring the Default Probabilities to the long-term Central Tendency.

In addition, after the calibration stage, the qualitative questionnaire on the monitoring model intervenes to notch the rating class, starting from specific intervals (cut-offs) of the qualitative scores (more specifically, each interval corresponds to a certain number of plus or minus notches on the rating class).

Finally, in the case of a Large Corporate, Mid Corporate Plus, Mid Corporate or Small Business segmented counterparty belonging to a Group or with a consolidating Parent Company which is Large Corporate or Mid Corporate Plus (with consolidated financial statements), the rules on notching (upgrading/downgrading of the counterparty’s rating) defined by the Group are applied.

Private Customer Model The default probability is calculated and attributed by counterparty. For customers shared with several banks in the Group, the principle of data accumulation is adopted in order to calculate a single rating for these counterparties.

The development sample is made up of all Private counterparties, that is counterparties whose legal nature is “Natural Persons or Joint Accounts of natural persons”, with an exposure recorded in relation to the Group banks, with no connection to a sole trader, or joint accounts of natural persons.

Each module is based on a different information source and provides an intermediate score, which contributes to the various integration functions that assign the final PD to the counterparty.

The model is made up of four elementary modules which contribute to determining the final counterparty PD through four integration functions, divided by seniority of relationship between customer and bank and by presence/absence of a new product.

125 Description of the Business and Private LGD models These models are differentiated by exposure bands, type of technical macro-form, presence/absence of guarantee and status of the counterparty (performing, past due, probable defaults and bad). These were estimated by analysing the losses suffered by the Group on historic defaults ( LGD workout), with a definition of default consistent with that applied to PD estimation models.

Conditionally upon entry into default status, some cases of resolution of their cycle may be associated with each counterparty, irrespective of the progress made in the intermediate stages of default. These cases may be:

 return to performing: or the case of a counterparty in default that returns to being part of the performing portfolio. This can happen both if the bank suffers no loss and if it does;

 closure of the position: when a counterparty in default does not become Bad and closes the commercial relationships with the bank during the status of Past Due or Probable Default. This can happen both if the bank suffers no loss and if it does;

 transfer to bad: the most serious status of default, from which it is not possible to return neither to a previous default status nor to performing. When a counterparty is transferred to Bad, all relationships with the Bank are closed, and the process begins of recovering the amount for which the counterparty is exposed.

All the possible routes that a counterparty in default may follow, and which were considered in the LGD models, are shown in the figure below:

126 The default statuses related to Past Due and Probable Default can occur as initial entry statuses or, only in cases of Probable Default, also later. A further possibility for resolution of the default is finally activation of the Revocatory procedure (or action), which can occur after transfer to Default status following a Closure or Return to Performing.

The LGD models consist of five versions, according to the administrative status of the counterparty.

In order to include the impacts deriving from recessive short-term periods in the LGD calculation structure, the downturn component is estimated on the basis of the type of portfolio being analysed. The addition of this effect to the LGD estimate is determined through the application of a specific correction factor (add-on). This approach consists of estimating the main components of the model in downturn periods identified along the historical series taken as a reference and verifying the impact with respect to the result obtained from the LGD estimate performed on the entire observation period.

The models also include the estimate of the indirect costs (administrative costs that are not directly attributable to the individual file), which is accessed through the following steps: identification of the average cost per year for a bad file, allocation—on the basis and duration of the file in default—of the annual average cost and, finally, prudential allocation of the same amount also for pre-bad statuses.

In addition, to comply with the legislative requirements on the subject the new LGD defaulted asset models it possible, through a bootstrapping approach with opportune identification of an extreme percentile of the distribution of the LGD averages, to identify unexpected values of losses (so-called LGD DA) the difference of which from the best estimate of LGD (the LGD ELBE) makes it possible to calculate (through the use of a specific regulatory formula) the Risk Weighted Assets on defaults.

Relation between internal and external ratings The attribution of internal and external models is presented below, with specific reference to the Standard & Poor’s rating.

Large Mid Corporate Private Mid Corporate Small Business S&P Rating Corporate Plus Customer model model model model model

AAA 1-2 - - - - AA 3 1 - - - A - 2 1 - 1 BBB 4 3 2-3 - 2-3 BB 5-6 4-6 4-5 1-3 4-6 B 7-10 7-9 6-9 4-9 7-9 CCC - C 11 10-11 10-11 10-11 10-11

127 Value of exposures by regulatory asset class EAD EAD Regulatory asset class Period average 31/12/2018 (Mar-18/Dec- 31/12/2017 Period average 18) Loan exposures to businesses - SMEs 27,111,106 28,204,212 25,200,884 26,502,932 - Other businesses 23,980,969 23,483,104 13,685,582 12,737,972 Total 51,092,074 51,687,316 38,886,466 39,240,904 Retail loan exposures - Exposures guaranteed by residential property: 5,125,394 5,327,954 4,581,157 3,432,264 SMEs - Exposures guaranteed by residential property: 24,738,206 25,097,005 17,192,017 16,326,271 Natural Persons

- Qualified retail revolving exposures 970,509 979,924 753,289 757,856 - Retail exposures: Others: SMEs 12,857,436 12,807,062 11,347,721 12,683,531 - Retail exposures: Others: Natural Persons 1,606,388 1,644,375 1,679,891 2,652,662 Total 45,297,933 45,856,321 35,554,075 35,852,585

EAD EAD Regulatory asset class Period average 31/12/2018 (Mar-18/Dec- 31/12/2017 Period average 18)

Exposures to securitisations (IRB - RBA approach) 7,632 421,455 5,788 8,107

TOTAL CREDIT RISK (IRB - RBA APPROACH) 7,632 421,455 5,788 8,107

Risk factors PD and LGD (average figures, reference period)

PERFORMING A-IRB 31/12/2018 31/12/2017

Performing portfolio PD LGD PD LGD Loan exposures to businesses 3.14% 25.53% 1.11% 30.49%

- SMEs 4.29% 22.93% 1.33% 27.83%

- Other businesses 2.18% 27.69% 0.85% 33.77%

Retail loan exposures 2.57% 17.33% 1.45% 24.38%

- Exposures guaranteed by residential property: SMEs 6.05% 15.01% 2.97% 16.36%

- Exposures guaranteed by residential property: Natural Persons 1.47% 10.35% 1.24% 16.33%

- Qualified retail revolving exposures 2.28% 29.61% 1.66% 46.98%

- Retail exposures: Others: SMEs 3.37% 30.93% 1.23% 35.41%

- Retail exposures: Others: Natural Persons 3.34% 16.70% 1.41% 34.01%

Total 2.85% 21.35% 1.29% 27.26%

Overall, we can note an increase in the PD of the performing portfolio compared to the figure recorded in December 2017 as well as a lower LGD. Note that the comparison between the two dates is not homogeneous given that, following validation in February 2018, the perimeter subject to the AIRB approach includes former BPM Spa exposures in the December 2018 figures. Additionally, both the PD and LGD risk parameters were re-estimated after an update to the definition of default.

128 EU CR6 - IRB Approach - Exposures to credit risk by exposure class and PD

Gross Off- original balance- EAD post Number Weighted Weighted Scale on- Average Weighted RWA Regulatory Portfolio sheet CRM and of average average RWAs EL Provisions PD balance- CCF average PD densities exposures post CCF debtors LGD maturity sheet pre-CCF exposures 0.00 to < 0.15 1,521,529 2,041,069 8.42% 1,633,720 0.10% 1,623 26.87% 2.01 221,544 13.56% 454 329 0.15 to < 0.25 2,284,920 1,441,282 8.26% 2,287,846 0.23% 2,133 23.87% 2.39 455,367 19.90% 1,254 1,191 0.25 to < 0.50 2,515,428 1,305,992 11.15% 2,533,508 0.44% 2,219 24.21% 2.31 724,248 28.59% 2,715 1,264 0.50 to < 0.75 626,162 201,577 18.99% 642,436 0.62% 1,001 18.37% 3.42 170,535 26.54% 735 241 0.75 to < 2.50 5,551,036 2,067,412 18.48% 5,745,626 1.47% 5,527 22.28% 2.79 2,443,595 42.53% 18,645 10,766 Exposures to or 2.50 to < 10.00 3,391,794 995,851 27.90% 3,562,343 5.29% 3,099 22.35% 3.16 2,265,189 63.59% 42,033 29,068 guaranteed by businesses - SMEs 10.00 to < 100.00 1,811,419 544,509 25.21% 1,919,770 25.61% 2,333 21.14% 3.45 1,806,378 94.09% 104,907 81,821 100.00 (Default) 8,631,053 474,645 25.49% 8,675,096 100.00% 11,733 49.56% - 2,147,784 24.76% 4,127,126 5,151,102 Past due 22,637 2,653 8.71% 21,806 100.00% 331 20.34% - 2,797 12.83% 4,211 3,423 UtP 3,254,880 418,507 16.31% 3,283,642 100.00% 1,615 26.89% - 637,794 19.42% 832,034 1,178,992 Default 5,353,537 53,485 98.19% 5,369,648 100.00% 9,787 63.53% - 1,507,192 28.07% 3,290,881 3,968,687 Subtotal 26,333,340 9,072,336 15.35% 27,000,345 35.04% 29,668 31.47% 2.77 10,234,639 37.91% 4,297,869 5,275,782 Total (all portfolios) 89,935,413 47,444,837 16.84% 96,175,114 16.88% 860,596 25.05% 2.55 27,541,550 28.64% 6,785,895 7,960,980

Gross Off- original balance- EAD post Weighted Number Weighted Weighted Scale on- Average RWA Regulatory Portfolio sheet CRM and average of average average RWAs EL Provisions PD balance- CCF densities exposures post CCF PD debtors LGD maturity sheet pre-CCF exposures 0.00 to < 0.15 5,215,582 12,188,132 14.35% 6,945,243 0.06% 1,349 28.44% 2.43 993,638 14.31% 1,249 1,556 0.15 to < 0.25 1,810,755 1,502,659 10.54% 1,958,740 0.18% 490 27.31% 1.85 441,371 22.53% 969 669 0.25 to < 0.50 4,451,334 4,315,712 19.00% 5,241,443 0.38% 628 27.04% 2.53 2,031,546 38.76% 5,384 2,594 0.50 to < 0.75 5,870 3,658 1.64% 5,930 0.62% 12 28.90% 2.07 2,868 48.36% 11 3 Exposures to or 0.75 to < 2.50 4,242,831 3,873,132 19.20% 4,964,858 1.20% 800 28.63% 2.23 3,045,416 61.34% 16,989 8,048 guaranteed by 2.50 to < 10.00 1,817,761 874,354 28.71% 2,067,211 4.92% 382 25.75% 2.50 1,798,768 87.01% 25,734 13,065 businesses - Other 10.00 to < 100.00 719,567 245,252 30.03% 777,681 36.91% 137 25.31% 2.70 1,030,807 132.55% 69,160 40,781 businesses 100.00 (Default) 1,688,553 941,103 26.28% 1,934,640 100.00% 210 36.64% - 464,543 24.01% 671,630 715,933 Past due 5 0 0.00% 5 100.00% 13 120.00% - 0 0.00% 6 3 UtP 1,517,632 922,437 24.79% 1,745,054 100.00% 165 32.52% - 397,359 22.77% 535,749 568,841 Default 170,916 18,665 100.00% 189,581 100.00% 32 74.51% - 67,184 35.44% 135,875 147,089 Subtotal 19,952,252 23,944,002 16.89% 23,895,745 10.09% 4,008 28.41% 2.37 9,808,956 41.05% 791,125 782,649 Total (all portfolios) 89,935,413 47,444,837 16.84% 96,175,114 16.88% 860,596 25.05% 2.55 27,541,550 28.64% 6,785,895 7,960,980 129 Gross Off- original balance- EAD post Weighted Number Weighted Weighted Scale on- Average RWA Regulatory Portfolio sheet CRM and average of average average RWAs EL Provisions PD balance- CCF densities exposures post CCF PD debtors LGD maturity sheet pre-CCF exposures 0.00 to < 0.15 7,199,083 37,793 4.88% 7,200,851 0.11% 71,301 10.30% - 193,240 2.68% 784 1,700 0.15 to < 0.25 3,544,217 20,923 4.37% 3,545,132 0.20% 40,825 10.36% - 156,453 4.41% 736 1,087 0.25 to < 0.50 6,079,235 23,272 4.09% 6,080,187 0.33% 65,151 10.33% - 385,316 6.34% 2,069 2,471 0.50 to < 0.75 3,021,360 24,046 3.73% 3,022,255 0.56% 36,590 10.39% - 282,677 9.35% 1,774 2,042 Retail exposures - 0.75 to < 2.50 2,252,360 21,066 5.25% 2,253,466 1.41% 25,481 10.44% - 383,444 17.02% 3,314 4,362 Exposures 2.50 to < 10.00 426,778 5,850 4.99% 427,070 4.90% 4,498 10.41% - 153,550 35.95% 2,178 5,804 guaranteed by property: natural 10.00 to < 100.00 855,570 4,983 3.34% 855,737 28.03% 8,668 10.48% - 517,162 60.43% 25,125 36,147 persons 100.00 (Default) 1,353,586 688 0.00% 1,353,507 100.00% 12,058 37.98% - 251,459 18.58% 493,963 696,958 Past due 7,080 0 0.00% 7,080 100.00% 182 10.88% - 29 0.41% 768 452 UtP 511,226 688 0.00% 511,175 100.00% 4,415 16.57% - 39,179 7.66% 81,588 78,278 Default 835,280 0 0.00% 835,252 100.00% 7,461 51.31% - 212,252 25.41% 411,607 618,228 Subtotal 24,732,189 138,620 4.45% 24,738,206 6.86% 264,572 11.86% - 2,323,302 9.39% 529,942 750,571 Total (all portfolios) 89,935,413 47,444,837 16.84% 96,175,114 16.88% 860,596 25.05% 2.55 27,541,550 28.64% 6,785,895 7,960,980

Gross Off- original balance- EAD post Weighted Number Weighted Weighted Scale on- Average RWA Regulatory Portfolio sheet CRM and average of average average RWAs EL Provisions PD balance- CCF densities exposures post CCF PD debtors LGD maturity sheet pre-CCF exposures 0.00 to < 0.15 15,630 186,210 100.01% 201,862 0.09% 28,717 25.34% - 3,075 1.52% 48 51 0.15 to < 0.25 16,372 78,539 100.20% 95,089 0.20% 15,025 26.15% - 2,816 2.96% 50 31 0.25 to < 0.50 25,625 91,487 98.49% 115,796 0.33% 18,963 27.62% - 5,420 4.68% 105 43 0.50 to < 0.75 30,584 81,472 88.94% 103,147 0.56% 16,883 28.87% - 7,756 7.52% 168 62 Retail exposures - 0.75 to < 2.50 126,284 191,928 90.29% 300,530 1.44% 60,747 33.50% - 52,702 17.54% 1,439 688 Qualified retail 2.50 to < 10.00 57,062 39,524 67.19% 84,632 4.90% 15,457 31.90% - 34,353 40.59% 1,323 723 revolving 10.00 to < 100.00 51,354 17,040 63.59% 63,696 19.06% 12,270 31.73% - 50,708 79.61% 3,881 1,783 exposures 100.00 (Default) 5,758 309 0.00% 5,758 100.00% 1,217 45.44% - 926 16.09% 2,542 1,677 Past due 1,542 6 0.00% 1,542 100.00% 416 34.96% - 188 12.19% 524 316 UtP 4,215 303 0.00% 4,215 100.00% 801 49.28% - 738 17.51% 2,018 1,362 Default 0 0 0.00% 0 0.00% 0 0.00% - 0 0.00% 0 0 Subtotal 328,668 686,509 92.96% 970,509 2.86% 169,279 29.71% - 157,756 16.25% 9,556 5,059 Total (all portfolios) 89,935,413 47,444,837 16.84% 96,175,114 16.88% 860,596 25.05% 2.55 27,541,550 28.64% 6,785,895 7,960,980

130 Gross Off- original balance- EAD post Weighted Number Weighted Weighted Scale on- Average RWA Regulatory Portfolio sheet CRM and average of average average RWAs EL Provisions PD balance- CCF densities exposures post CCF PD debtors LGD maturity sheet pre-CCF exposures 0.00 to < 0.15 215,792 123,186 11.01% 229,406 0.10% 11,003 14.75% - 8,497 3.70% 32 61 0.15 to < 0.25 136,397 101,172 8.11% 144,613 0.20% 7,978 15.81% - 9,828 6.80% 46 52 0.25 to < 0.50 170,478 273,632 7.33% 190,655 0.33% 12,973 16.57% - 18,780 9.85% 104 80 0.50 to < 0.75 140,193 198,262 7.73% 155,665 0.56% 10,822 16.75% - 21,260 13.66% 147 211 Retail exposures - 0.75 to < 2.50 321,414 209,281 13.40% 349,799 1.43% 32,919 18.04% - 75,089 21.47% 881 599 Other retail 2.50 to < 10.00 113,305 70,301 22.76% 129,749 4.90% 9,565 15.95% - 32,312 24.90% 1,014 885 exposures: natural 10.00 to < 100.00 148,531 40,673 20.01% 155,353 20.56% 22,665 18.13% - 63,284 40.74% 5,974 4,300 persons 100.00 (Default) 249,571 2,520 58.59% 250,822 100.00% 29,077 66.29% - 78,074 31.13% 160,032 173,538 Past due 8,545 164 20.52% 8,572 100.00% 9,299 33.89% - 722 8.43% 2,848 1,696 UtP 57,387 1,011 21.54% 57,434 100.00% 8,738 32.41% - 8,577 14.93% 17,930 26,403 Default 183,638 1,345 91.09% 184,816 100.00% 11,040 78.32% - 68,775 37.21% 139,255 145,439 Subtotal 1,495,681 1,019,025 10.87% 1,606,061 18.44% 137,002 24.44% - 307,122 19.12% 168,231 179,726 Total (all portfolios) 89,935,413 47,444,837 16.84% 96,175,114 16.88% 860,596 25.05% 2.55 27,541,550 28.64% 6,785,895 7,960,980

Gross Off- original balance- EAD post Weighted Number Weighted Weighted Scale on- Average RWA Regulatory Portfolio sheet CRM and average of average average RWAs EL Provisions PD balance- CCF densities exposures post CCF PD debtors LGD maturity sheet pre-CCF exposures 0.00 to < 0.15 194,277 8,607 14.07% 195,489 0.11% 1,882 11.50% - 4,481 2.29% 24 47 0.15 to < 0.25 388,476 27,016 9.88% 391,146 0.20% 2,793 14.62% - 18,651 4.77% 115 65 0.25 to < 0.50 486,551 43,636 8.27% 490,161 0.36% 4,112 13.50% - 33,474 6.83% 243 179 0.50 to < 0.75 405,262 25,938 6.38% 406,917 0.61% 3,028 14.69% - 43,405 10.67% 365 282 Retail exposures - 0.75 to < 2.50 1,309,872 157,717 6.29% 1,319,344 1.51% 8,596 15.46% - 266,133 20.17% 3,076 2,079 Exposures 2.50 to < 10.00 779,217 79,081 5.91% 783,359 4.94% 4,931 15.83% - 322,707 41.20% 6,126 6,019 guaranteed by 10.00 to < 100.00 791,509 27,186 6.10% 790,859 25.43% 6,418 15.63% - 532,433 67.32% 31,296 30,011 property: SMEs 100.00 (Default) 751,764 4,645 0.00% 748,119 100.00% 4,595 29.70% - 106,871 14.29% 213,627 294,335 Past due 11,898 85 0.00% 11,898 100.00% 117 13.55% - 273 2.30% 1,591 1,127 UtP 396,472 4,560 0.00% 394,796 100.00% 2,229 18.49% - 39,737 10.07% 69,818 60,141 Default 343,395 0 0.00% 341,425 100.00% 2,249 43.22% - 66,860 19.58% 142,218 233,067 Subtotal 5,106,928 373,825 6.79% 5,125,394 19.76% 36,355 17.16% - 1,328,156 25.91% 254,873 333,017 Total (all portfolios) 89,935,413 47,444,837 16.84% 96,175,114 16.88% 860,596 25.05% 2.55 27,541,550 28.64% 6,785,895 7,960,980

131 Gross Off- original balance- EAD post Weighted Number Weighted Weighted Scale on- Average RWA Regulatory Portfolio sheet CRM and average of average average RWAs EL Provisions PD balance- CCF densities exposures post CCF PD debtors LGD maturity sheet pre-CCF exposures 0.00 to < 0.15 530,864 2,814,126 10.97% 810,089 0.09% 4,793 29.79% - 43,772 5.40% 220 156 0.15 to < 0.25 1,758,600 2,508,294 12.33% 1,929,716 0.21% 16,163 29.31% - 190,751 9.88% 1,183 361 0.25 to < 0.50 1,514,082 1,778,887 12.31% 1,615,463 0.41% 15,784 29.46% - 246,272 15.24% 1,950 651 0.50 to < 0.75 976,812 884,138 17.56% 1,058,806 0.62% 16,259 30.70% - 213,443 20.16% 2,024 550 0.75 to < 2.50 3,387,797 2,665,798 17.45% 3,596,218 1.45% 60,682 31.08% - 1,036,283 28.82% 16,285 6,020 Retail exposures - 2.50 to < 10.00 1,748,712 1,006,563 20.78% 1,816,521 4.97% 39,145 32.39% - 702,330 38.66% 29,175 14,989 Other retail exposures: SMEs 10.00 to < 100.00 1,097,654 418,134 20.53% 1,088,878 22.11% 41,457 34.18% - 649,058 59.61% 83,168 44,201 100.00 (Default) 971,834 134,580 17.09% 923,163 100.00% 25,429 67.62% - 299,709 32.47% 600,296 567,249 Past due 38,669 13,389 5.67% 34,356 100.00% 5,169 34.25% - 5,786 16.84% 11,305 8,199 UtP 392,102 108,074 8.44% 371,990 100.00% 10,108 44.28% - 93,236 25.06% 157,253 159,191 Default 541,063 13,118 99.96% 516,817 100.00% 10,152 86.64% - 200,687 38.83% 431,738 399,858 Subtotal 11,986,354 12,210,520 14.54% 12,838,854 10.32% 219,712 33.57% - 3,381,618 26.34% 734,300 634,176 Total (all portfolios) 89,935,413 47,444,837 16.84% 96,175,114 16.88% 860,596 25.05% 2.55 27,541,550 28.64% 6,785,895 7,960,980

132 Effective write-downs

Amount Amount Regulatory asset class 31/12/2018 31/12/2017

Net write-downs

BUSINESSES-Exposures to SMEs 5,305,245 5,027,151

BUSINESSES-Exposures to Other businesses 787,196 467,296

RETAIL-Exposures guaranteed by residential property: SMEs 5,059 309,339

RETAIL-Exposures guaranteed by residential property: natural persons 179,757 898,036

RETAIL-Qualified retail revolving exposures 635,545 2,633

RETAIL-Other retail exposures: SMEs 750,571 445,585

RETAIL-Other retail exposures: natural persons 333,017 102,549

Total 7,996,390 7,252,589

Effective writedowns (trend - performing/default)

Total write-downs Regulatory asset class 31/12/2018 31/12/2017 S E

S Exposures to SMEs 128,601 58,420 S E N I S Exposures to Other businesses 71,247 24,719 G U B N I

M Exposures guaranteed by residential property: SMEs 38,682 16,379 R O

F Exposures guaranteed by residential property: natural persons 53,613 8,951 L I R E A T P Qualified retail revolving exposures 3,381 1,116 E R Other retail exposures: SMEs 67,675 40,155 Other retail exposures: natural persons 6,201 2,103 Total PERFORMING 369,400 151,845 S E

S Exposures to SMEs 5,176,644 4,968,731 S E N I S Exposures to Other businesses 715,949 442,577 U B T L

U Exposures guaranteed by residential property: SMEs 294,335 292,960 A F E Exposures guaranteed by residential property: natural persons 696,958 889,084 L D I A

T Qualified retail revolving exposures 1,677 1,517 E R Other retail exposures: SMEs 567,870 405,430 Other retail exposures: natural persons 173,556 100,445 Total DEFAULT 7,626,989 7,100,744 Total 7,996,390 7,252,589

Note that the trend in writedowns with respect to the figure at December 2017 was especially affected by:  an increase due to the switch from calculating compliant writedowns using the rules under accounting standard IFRS 9;  a decrease due to the sale of the Exodus portfolio of NPLs;  an increase based on the planned sales of the ACE portfolio of NPLS.

133 EU CR7 - IRB Approach - Effect on RWAs of credit derivatives used in the context of CRM techniques

RWAs before the effect Effective RWAs of credit derivatives

Exposures based on FIRB Central administrations and central banks n/a n/a Institutions n/a n/a Businesses – SMEs n/a n/a Businesses – Specialised loans n/a n/a Businesses – Other n/a n/a Exposures based on AIRB Central administrations and central banks n/a 0 Institutions n/a 0 Businesses – SMEs n/a 10,300,639 Businesses – Specialised loans n/a 0 Businesses – Other n/a 9,871,379 Retail – SMEs guaranteed by property n/a 1,328,156 Retail – Non-SMEs guaranteed by property n/a 2,323,302 Retail – Qualified revolving n/a 157,756 Retail – Other SMEs n/a 3,386,094 Retail – Other non-SMEs n/a 307,170 Equity instruments with IRB n/a Other assets different from loans n/a Total n/a 27,674,495

Comparison between estimates and effective results The Banco BPM uses internal PD, LGD and EAD estimates for the purposes of calculating capital requirements relative to credit risk.

The comparison between estimates and empirical data is done for all risk parameters through backtesting performed by the Internal Validation function.

With reference to the PD models, the Banco BPM Group adopts performance measurements to check the accuracy ratio (AR) of the estimates and calibration tests (“classical” binomial test over an annual and multi-annual period) to compare the decay rates (DRs) recorded over an annual time horizon with the estimated PD values.

As regards the Business segment, from the latest backtesting there emerges a good accuracy ratio of the models at the level both of single modules and of final integrated score, which comes out at values comparable to those obtained in the development stage.

With regards to calibration, for all corporate models (Large Corporate, Mid Corporate Plus, Mid Corporate and Small Business) values indicate greater prudentiality than the PD value for the class with respect to the decay rate recorded are deemed satisfactory.

134 In relation to the Private Customer segment, overall the model performed well. As regards calibration, the results of the binomial tests were satisfactory.

Analysis done at the time the LGD model was extended to the BPM perimeter indicated substantial validity of the model. Verification activities involved the discriminating capacity of the model.

The most recent investigations done on the Probability of Default parameter were, for both the Business and Private segments, in line with expectations if compared with the results obtained in the estimate.

Analysis done at the time of initial validation of the EAD model for the retail component indicated substantial validity of the model. Also for this parameter, the validation framework involves the performance of statistical tests in order to verify resistance over time.

In general, note that during 2018 fine tuning was done on all models, with the aim of overcoming the areas of attention identified by the Internal Validation function during its verification activities.

Comparison between PD and default (DR) data by exposure class In this paragraph Internal Validation puts default rates into relation with estimated PDs, dividing the IRB regulatory portfolio at the reference date of 31 December 2017. The exposure classes are further divided by PD scale, as defined in table EU CR67. The reference database is the reporting environment, defining regulatory default.

The IRB internal models, included in the IRB regulatory exposure classes, are:

- Large Corporate, turnover/assets ≥ 500 mln

- Mid Corporate Plus, turnover/assets between 50 and 500 mln

- Mid Corporate, turnover/assets between 5 and 50 mln

- Small Business, turnover/assets < 5 mln

- Private Customers

Unlike the Private Customer segment, the first four models come within the Business macro- category.

With reference to the reporting of 31 December 2018, the division in terms of RWAs of the internal models for IRB regulatory exposure classes is as follows:

Internal Models %RWAs Large Corporate 12.46% Mid Corporate Plus 22.85% Mid Corporate 28.02% Small Business 25.78% Private Customers 10.89%

7 Reference EBA Guidelines (EBA-GL-2016-11). 135 For the figures contained in the table below, note that: - starting from 31 March 2018, the Banco BPM Group obtained authorisation to put the new A-IRB models into production, with extension to the former BPM perimeter. The new models also incorporate the new definition of default at 90 days, with absolute materiality threshold of Past Due loans differentiated between Business and Private Customers. The DRs shown were instead calculated applying the regulatory default, obtaining in this way more conservative results; - owing to the mapping to IRB of debtors coming from the former BPM during the performance year analysed, and subsequent incorporation of BPM s.p.a. into Banco BPM s.p.a., it was decided to show the DRs only for the former BP perimeter, while the “Number of debtors End of year” column takes into account also the former BPM counterparties; - the equivalent external rating is not shown because shadow rating models are not used in determining the PD estimate; - the annual historic average default rate is calculated over 5 years: 2017-2013, with the PD threshold relative to the models in effect each year.

136 EU CR9 - IRB Approach – Backtesting of the DP by exposure class

Equivalent Weighted Number of debtors Debtors in default Arithmetic average Of which Average historical Exposure class PD scale external average of the status during the of the PD by debtors End of previous End of the new debtors annual default rate rating PD year year year 0.00 to < 0.15 0.10% 0.09% 7,901 1,623 9 0 0.21% 0.15 to < 0.25 0.23% 0.22% 4,266 2,133 19 1 0.43% 0.25 to < 0.50 0.44% 0.43% 4,771 2,219 43 0 0.99% Exposures to or guaranteed by 0.50 to < 0.75 0.62% 0.62% 2,455 1,001 34 0 1.88% businesses - SMEs 0.75 to < 2.50 1.47% 1.46% 4,883 5,527 157 7 3.87% 2.50 to < 10.00 5.29% 5.11% 2,745 3,099 288 19 11.22% 10.00 to < 100.00 25.61% 23.67% 1,088 2,333 610 277 36.16%

Equivalent Weighted Number of debtors Debtors in default Arithmetic average Of which Average historical Exposure class PD scale external average of the status during the of the PD by debtors End of previous End of the new debtors annual default rate rating PD year year year 0.00 to < 0.15 0.06% 0.06% 1,377 1,349 5 0 0.16% 0.15 to < 0.25 0.18% 0.18% 55 490 0 0 0.22% Exposures to or 0.25 to < 0.50 0.38% 0.39% 475 628 2 0 0.84% guaranteed by 0.50 to < 0.75 0.62% 0.62% 442 12 2 0 0.84% businesses - Other businesses 0.75 to < 2.50 1.20% 1.25% 517 800 14 1 3.24% 2.50 to < 10.00 4.92% 4.98% 114 382 29 6 10.90% 10.00 to < 100.00 36.91% 32.77% 27 137 15 2 33.54%

Equivalent Weighted Number of debtors Debtors in default Arithmetic average Of which Average historical Exposure class PD scale external average of the status during the of the PD by debtors End of previous End of the new debtors annual default rate rating PD year year year 0.00 to < 0.15 0.11% 0.11% 69,191 71,301 72 0 0.12% 0.15 to < 0.25 0.20% 0.20% 2 40,825 1 1 0.15% Retail exposures - 0.25 to < 0.50 0.33% 0.33% 41,513 65,151 74 0 0.15% Exposures guaranteed by 0.50 to < 0.75 0.56% 0.56% 36,053 36,590 134 2 0.50% property: natural 0.75 to < 2.50 1.41% 1.39% 7,057 25,481 102 0 1.82% persons 2.50 to < 10.00 4.90% 4.90% 5,853 4,498 271 1 6.50% 10.00 to < 100.00 28.03% 28.14% 4,102 8,668 877 23 23.94%

137 Equivalent Weighted Number of debtors Debtors in default Arithmetic average Of which Average historical Exposure class PD scale external average of the status during the of the PD by debtors End of previous End of the new debtors annual default rate rating PD year year year 0.00 to < 0.15 0.09% 0.10% 32,008 28,717 13 1 0.07% 0.15 to < 0.25 0.20% 0.20% 2 15,025 0 0 0.11% Retail exposures - 0.25 to < 0.50 0.33% 0.33% 19,802 18,963 23 0 0.12% Qualified retail 0.50 to < 0.75 0.56% 0.56% 19,356 16,883 52 0 0.37% revolving exposures 0.75 to < 2.50 1.44% 1.41% 24,530 60,747 185 12 0.87% 2.50 to < 10.00 4.90% 4.90% 25,077 15,457 796 12 3.60% 10.00 to < 100.00 19.06% 19.85% 2,257 12,270 646 63 25.99%

Equivalent Weighted Number of debtors Debtors in default Arithmetic average Of which Average historical Exposure class PD scale external average of the status during the of the PD by debtors End of previous End of the new debtors annual default rate rating PD year year year 0.00 to < 0.15 0.10% 0.10% 16,400 11,003 57 19 0.45% 0.15 to < 0.25 0.20% 0.20% 0 7,978 30 30 0.60% Retail exposures - 0.25 to < 0.50 0.33% 0.33% 7,335 12,973 63 37 0.29% Other retail 0.50 to < 0.75 0.56% 0.56% 20,120 10,822 350 102 1.55% exposures: natural persons 0.75 to < 2.50 1.43% 1.40% 11,371 32,919 1,694 1,286 4.37% 2.50 to < 10.00 4.90% 4.90% 27,473 9,565 5,160 1,639 14.84% 10.00 to < 100.00 20.56% 24.17% 9,220 22,665 7,846 4,173 42.13%

Equivalent Weighted Number of debtors Debtors in default Arithmetic average Of which Average historical Exposure class PD scale external average of the status during the of the PD by debtors End of previous End of the new debtors annual default rate rating PD year year year 0.00 to < 0.15 0.11% 0.11% 3,939 1,882 8 0 0.21% 0.15 to < 0.25 0.20% 0.20% 1,843 2,793 1 0 0.27% Retail exposures - 0.25 to < 0.50 0.36% 0.35% 4,655 4,112 10 0 0.28% Exposures 0.50 to < 0.75 0.61% 0.59% 4,980 3,028 33 0 0.84% guaranteed by property: SMEs 0.75 to < 2.50 1.51% 1.51% 3,271 8,596 52 0 1.88% 2.50 to < 10.00 4.94% 4.97% 4,167 4,931 196 1 5.79% 10.00 to < 100.00 25.43% 26.58% 2,932 6,418 463 9 17.98%

138 Equivalent Weighted Number of debtors Debtors in default Arithmetic average Of which Average historical Exposure class PD scale external average of the status during the of the PD by debtors End of previous End of the new debtors annual default rate rating PD year year year 0.00 to < 0.15 0.09% 0.09% 17,643 4,793 12 1 0.11% 0.15 to < 0.25 0.21% 0.20% 17,357 16,163 41 1 0.26% 0.25 to < 0.50 0.41% 0.39% 23,281 15,784 94 5 0.40% Retail exposures - Other retail 0.50 to < 0.75 0.62% 0.62% 24,557 16,259 243 14 0.97% exposures: SMEs 0.75 to < 2.50 1.45% 1.51% 21,589 60,682 598 114 2.25% 2.50 to < 10.00 4.97% 4.93% 28,631 39,145 2,604 367 8.18% 10.00 to < 100.00 22.11% 22.99% 15,359 41,457 8,087 3,307 31.22%

139 Risk Mitigation Techniques

Types of guarantees

Techniques used to mitigate credit risk include accessory contracts or other instruments and techniques which the Banco BPM Group acquires in its execution of its banking business, aimed at reducing credit risk.

The main types of collateral guarantees used by the Banco BPM Group can be summarised within the macrocategories indicated below:

. mortgages on real estate assets (residential and commercial);

. pledges on cash, securities and mutual funds deposited with the Bank;

. pledges on insurance policies;

. pledges on goods;

. pledges on cash/securities deposited with third parties;

. mortgages on registered moveable assets.

The first two types of guarantees represent the majority of collateral acquired and comply with the technical/legal/organisational requirements indicated under the new regulatory provisions for the application of the rules established for credit risk mitigation.

For both of these macrocategories of collateral, there are:

. IT procedures which cover all aspects associated with management of this collateral (acquisition, valuation, management, repayment/enforcement);

. internal norms for all involved organisational structures (network and central structures), governing the roles and responsibilities and providing both regulatory and technical/operational support indications.

At the time the collateral is acquired:

. all documentation relative to the collateral is collected

. the individual collateral contracts and relative set of information needed for managerial/reporting/financial reporting needs are registered in the relevant applications

. formal and substantial controls on the collateral acquired are performed

. completeness of documents is ascertained and proper filing is checked.

In particular, for mortgages, initial acquisition of the value of the real estate asset occurs at the time the loan is disbursed, on the basis of an appraisal issued by independent technicians for any amount of credit requested and/or the value of the asset; all the data regarding the asset used as collateral (e.g. cadastral information, periodic reappraisals, etc.) are acquired during the disbursement process through a specific IT procedure dedicated to cataloguing, managing and querying data relative to real estate used as collateral;

140 Monitoring guarantees In order to continuously monitor the integrity and capacity of guarantees acquire, as well as to comply with the regulatory requirement of adequate surveillance and determine the value of risk mitigation to include when calculating capital requirements, the value of financial and real estate collateral is updated over time.

In particular, for real estate collateral, specific rules for updating values using statistical methods have been established.

Following statistical revaluations, assets which meet conditions for updating the relative appraisal are identified. Additionally, in compliance with the rules established in the EBA Guidelines, periodic reviews of appraisals are also required for real estate assets exceeding pre-established thresholds.

Relative to pledges, the following is required:

. initial acquisition of the value of the pledge when the loan is disbursed, on the basis of its market value adjusted by a prudential haircut (percentage of the value of the security used as collateral) and differentiated based on the type and risk level of the underlying security;

. daily update of the market value of securities pledged, including the prudential haircut applied as a function of the type and riskiness of the security, with automatic notification of actions to update the guarantee in the case its value falls below the pre-established thresholds for the coverage parameters envisaged.

Credit derivative transactions The Banco BPM Group can carry out transactions to hedge exposures with credit derivatives, with national and international counterparties of excellent standing.

With regards to its activities in derivatives with institutional counterparties and in line with best market practices, the Banco BPM Group has ISDA agreements supported by CSAs to mitigate counterparty risk.

Market and credit risk concentrations Real estate collateral constitutes the largest part of instruments used to attenuate credit risk. The structure of the Group's loan portfolio for the most part consists of loans to private individuals and small and medium enterprises. This favours the limitation of concentration, also in the context of risk mitigation tools.

Analysis of changes in real estate values is done periodically, in order to measure the resistance of the same.

The tables below show the values of exposures covered by personal guarantees, real financial collateral and other collateral. Distribution of exposures covered by real guarantees, personal guarantees or credit derivatives by regulatory classes of assets

Exposures subject to the STANDARD APPROACH - Exposures covered by guarantees

31/12/2018 31/12/2017 Regulatory Portfolio PERSONAL REAL PERSONAL REAL GUARANTEES GUARANTEES GUARANTEES GUARANTEES

Exposures to or guaranteed by central administrations 0 0 0 0 and central banks

Exposures to or guaranteed by regional administrations or 0 0 0 0 local authorities

Exposures to or guaranteed by public sector 1,903 0 2,153 0 organisations Exposures to or guaranteed by multilateral development 0 0 0 0 banks

Exposures to or guaranteed by international organisations 0 0 0 0

Exposures to or guaranteed by intermediaries subject to 237,726 22,059,907 169,181 13,682,360 supervision Exposures to or guaranteed by businesses and other 192,113 472,712 288,395 235,749 entities Retail exposures 4,600 42,234 259,491 144,513

Exposures guaranteed by property 0 424 568 3,055

Exposures in default 11,379 6,427 48,113 6,248

High risk exposures 455 754 0 0

Exposures in the form of covered bank bonds 0 0 0 0

Short-term exposures to businesses 0 0 0 0

Exposures to undertakings for collective investment in 3,249 425,357 0 998,035 transferable securities (UCITS)

Equity exposures 0 0 0 2,105

Other exposures 0 0 0 0

Total 451,425 23,007,816 767,900 15,072,066 Exposures subject to the AIRB APPROACH - Exposures covered by guarantees

31/12/2018 31/12/2017

Regulatory Portfolio PERSONAL REAL PERSONAL REAL GUARANTEES GUARANTEES GUARANTEES GUARANTEES

Exposures to or guaranteed by enterprises 895,153 16,392,967 686,532 13,428,592

Specialised loans 0 0 0 0

SMEs 746,929 12,419,375 633,470 10,969,221

Other businesses 148,224 3,973,592 53,062 2,459,372

Retail exposures 1,004,196 32,471,925 460,082 22,082,703

Exposures guaranteed by residential property: SMEs 6,945 5,322,967 9,173 4,439,781

Exposures guaranteed by residential property: natural persons 157 24,555,054 102 16,743,742

Qualified retail revolving exposures 0 0 0 0

Other retail exposures: SMEs 993,474 2,456,833 450,665 772,775

Other retail exposures: natural persons 3,620 137,071 143 126,404

TOTAL 1,899,349 48,864,892 1,146,614 35,511,295

EU CR3 – CRM Techniques – Overview

Exposures Exposures Exposures Unsecured Unsecured secured by secured by secured by exposures – exposures – collateral collateral credit Book value Book value guarantees guarantees derivatives

Total loans 41,296,173 64,508,335 51,523,080 12,985,255 0 Total debt securities 34,305,906 0 0 0 0 Total exposures 115,496,901 114,543,263 71,872,708 42,670,556 0 Of which in default status 3,536,455 6,404,597 6,216,630 187,967 0 Counterparty Risk

Approach and policies Counterparty risk is a type of credit risk, defined as the risk that the counterparty in a transaction enters default prior to the definitive settlement of the cashflows relative to the transaction.

The risk is bilateral (the value of the transaction may be positive or negative for both counterparties), the development of which depends both upon changes in market parameters and on the riskiness of the counterparty (PD and LGD).

Policies relative to guarantees and measurements of counterparty risk depend on the type of financial instruments traded which, in line with the regulatory scope, may fall into one of the following categories: . Over the Counter (OTC) derivatives . Securities Financing Transactions (SCT): these typically are associated with repurchase agreements receivable or payable regarding securities or goods, transactions to buy/sell/loan securities or goods and loans with margins Medium/long-term loans . Transactions with long-term settlement: transactions with a settlement or delivery date after that used in general market practice or with respect to five business days following the date the transaction is stipulated by the entity, if prior

With an eye to improving risk mitigation relative to the counterparties with which it has OTC derivative transactions, ISDA Master Agreement and Credit Support Annexes (CSA) can be prepared, which respectively provide for netting and payment of reciprocal financial guarantees.

Risk deriving from the execution of securities loan transactions and repurchase agreements is mitigated through Global Master Securities Lending Agreements (GMSLA) and Global Master Repurchase Agreements (GMRA) with the aim of establishing a system of guarantees.

Forward exchanges may be included under CSAs and hence subject to margining, as occurs for OTC derivatives.

Capital requirements relative to counterparty risk relate to both positions in the trading book and those in the banking book.

When quantifying its exposure to risk, the Banco BPM Group uses for regulatory purposes the market value method (article 274, Regulation EU 575/2013) for OTC traded derivatives, while for SFT type transactions (repurchase agreements and securities loans) it adopts the integral approach, applying regulatory adjustments (articles 223 and 224, Regulation EU 575/2013) to take the relative volatility into account.

The Banco BPM Group also adopts its own methods for internal use to estimate exposure of OTC financial derivatives, on which economic capital needed to deal with the maximum loss is calculated. In general, models for internal use include revaluation of the market value for future scenarios through an historical simulation-based approach, considering correlations between risk factors which influence price (interest rates, exchange rates, stock prices).

The presence of any risk mitigation agreements between the parties (netting and collateral agreements) and the type of transactions imply diversification of methods used to calculate expected future exposure, defined as the expected value of the loss at present conditional on the fact that at a future date the counterparty goes into default.

In particular, relative to counterparties with which a collateral agreement has been signed (Credit Support Annex – CSA) as a guarantee and to mitigate risk, the expected exposure is measured on the basis of possible changes in the mark to market relative to the contracts underlying the CSA in question, over a time horizon given as the characteristics "period of margin at risk" for each contract.

This measure is also implemented in the chain of credit processes for derivative positions held with guaranteed counterparties, through the attribution of specific lines of credit, the revision of usage values and the development of tools to support monitoring. Prudentially, corrective factors are applied to the measured exposure, including a "wrong way risk" indicator, equal to a fixed 1.2.

In the context of the contractual negotiation of the CSA, a threshold is determined, normally set at zero, which when exceeded leads to the obligation of providing guarantees.

The guarantees, generally provided in the form of cash, are updated based on the frequency indicated in the contract (generally daily), either increasing or decreasing in relation to changes in market value equal to, or exceeding, a minimum amount established in the contract for each counterparty.

Exposure to counterparty risk, mitigated by the effects of contractual netting, represents around 63% of total exposure for OTC financial instruments traded.

Negotiation of guarantee agreements (Credit Support Annexes) mainly occurs in the absence of clauses with impacts on the amount of guarantees to be provided in the case the Group's credit standing is downgraded.

On the basis of the valuations of contracts negotiated at 28/12/2018, this impact is irrelevant: collateral is represented by cash (not subject to "haircuts"); for one counterparty, the guarantee consists of government securities to which the established haircuts have already been applied.

In compliance with the Basel 3 Regulatory Scheme, additional capital requirements are also calculated with regards to:

. own funds for the Credit Valuation Adjustment (CVA Risk) through adoption of the standardised approach, as envisaged in Regulation (EU) 575/13 for banks not authorised to use the IMM method for counterparty risk and the internal models method for the Incremental Risk Charge (IRC);

. exposures relative to transactions with qualified central counterparties (QCCP), through the adoption of the methods envisaged under articles 305, 306 and 308 of Regulation EU 575/2013. With regards to exposures with qualified central counterparties (QCCP), Group companies are direct participants with certain sectors of the Cassa di Compensazione e Garanzia.

For the purposes of adapting to Regulation (EU) 648/2012 ( "EMIR") indirect adhesion to the London Clearing House LCH is active, for OTC derivatives transactions, and with the central counterparty ICE Clear Europe for credit derivative transactions (3 contracts acquired for a total notional value of € 125 million; specifically, 1 contract for € 75 million, 2 contracts for € 25 million each).

Reporting system The reporting process includes a periodic managerial reporting system, with aggregate and detailed analysis of the main factors determining counterparty risk.

By way of example, trend data for risk and exposure is provided, broken down by segment (OTC derivatives, SFT transactions) and by legal entity.

The reporting system also includes daily monitoring of usage amounts relative to credit lines for OTC derivative transactions supported by Credit Support Annexes, also highlighting any overdrafts which may occur.

Counterparty risk - EAD and weighted values (RWA)

EAD value Weighted values (RWA) Type of Instrument Standardised IRB Standardised IRB approach approach approach approach SFT transactions 2,034,095 34 460,292 1 Derivative contracts and transactions with long- 715,030 214,859 280,969 132,944 term settlement Offsetting between different products 0 0 0 0

Total as at 31 December 2018 2,749,126 214,892 741,262 132,945

The division between the standardised approach and the IRB approach refers to the estimation methods for credit parameters used to calculated risk.

Financial hedging derivatives: notional values at end of period

31/12/2018 Over the counter

Underlying assets/Type of derivatives Without central counterparties Organised Central markets counterparties With netting Without netting agreements agreements

1. Debt securities and interest rates 11,163,082 8,541,210 1,100,000 0 a) Options 0 5,177 0 0 b) Swap 11,163,082 8,536,033 1,100,000 0 2. Equity securities and stock indexes 0 0 0 0 3. Currencies and gold 0 0 0 0 4. Goods 0 0 0 0 5. Other 0 0 0 0 Total 11,163,082 8,541,210 1,100,000 - OTC financial hedging derivatives - notional values, gross positive and negative fair value by counterparty

31/12/2018 Underlying assets Central Other financial Banks Other entities counterparties companies Contracts not falling under netting agreements 1) Debt securities and interest rates - notional value 1,100,000 0 0 - positive fair value 1,958 0 0 - negative fair value 0 0 0 2) Equity securities and stock indexes - notional value 0 0 0 - positive fair value 0 0 0 - negative fair value 0 0 0 3) Currencies and gold - notional value 0 0 0 - positive fair value 0 0 0 - negative fair value 0 0 0 4) Goods - notional value 0 0 0 - positive fair value 0 0 0 - negative fair value 0 0 0 5) Other - notional value 0 0 0 - positive fair value 0 0 0 - negative fair value 0 0 0 Contracts falling under netting agreements 1) Debt securities and interest rates - notional value 11,163,082 7,814,006 727,204 0 - positive fair value 31,521 1 14 0 - negative fair value 89,590 398,876 139,605 0 2) Equity securities and stock indexes - notional value 0 0 0 0 - positive fair value 0 0 0 0 - negative fair value 0 0 0 0 3) Currencies and gold - notional value 0 0 0 0 - positive fair value 0 0 0 0 - negative fair value 0 0 0 0 4) Goods - notional value 0 0 0 0 - positive fair value 0 0 0 0 - negative fair value 0 0 0 0 5) Other - notional value 0 0 0 0 - positive fair value 0 0 0 0 - negative fair value 0 0 0 0 Financial trading derivatives: notional values at end of period

31/12/2018 Underlying assets/Type of derivatives Over the counter

Without central counterparties Organised Central markets counterparties With netting Without netting agreements agreements

1. Debt securities and interest rates 35,315,089 45,205,273 12,967,287 946,500 a) Options 17,226,827 2,882,314 175,000 b) Swap 35,315,089 27,978,446 7,167,497 d) Futures 2,917,476 771,500 2. Equity securities and stock indexes 0 9,065,241 1,662,187 739,902 a) Options 9,065,241 1,447,505 720,375 d) Futures 214,682 19,527 3. Currencies and gold 0 23,236,442 1,208,907 0 a) Options 890,402 235,723 b) Swap 3,693 41,968 c) Forward 22,342,347 931,216 4. Goods 33,350 5,804 Total 35,315,089 77,540,306 15,844,185 1,686,402

OTC financial trading derivatives - notional values, gross positive and negative fair value by counterparty

31/12/2018

Underlying assets Central Other financial Banks Other entities counterparties companies Contracts not falling under netting agreements 1) Debt securities and interest rates - notional value 647,566 3,356,414 8,963,307 - positive fair value 109 9,925 160,291 - negative fair value 11 20 3,914 2) Equity securities and stock indexes - notional value 0 398,642 1,263,545 - positive fair value 0 21,541 19,916 - negative fair value 0 5,036 956,526 3) Currencies and gold - notional value 547,641 32,079 629,187 - positive fair value 5,864 42 3,792 - negative fair value 2,443 113 12,061 4) Goods - notional value 0 0 5,804 - positive fair value 0 0 15 - negative fair value 0 0 49 5) Other - notional value 0 0 0 - positive fair value 0 0 0 - negative fair value 0 0 0 Contracts falling under netting agreements 1) Debt securities and interest rates - notional value 35,315,089 28,365,148 16,199,947 640,177 - positive fair value 235,973 613,458 346,971 12,122 - negative fair value 345,469 752,356 290,034 23,067 2) Equity securities and stock indexes - notional value 0 4,889,926 4,175,315 0 - positive fair value 0 115,728 144,809 0 - negative fair value 0 114,230 273,177 0 3) Currencies and gold - notional value 0 19,969,556 2,803,013 463,874 - positive fair value 0 285,364 34,246 2,629 - negative fair value 0 233,704 29,607 8,738 4) Goods - notional value 0 1,091 25,389 6,870 - positive fair value 0 73 3,230 0 - negative fair value 0 75 905 2,004 5) Other - notional value 0 0 0 0 - positive fair value 0 0 0 0 - negative fair value 0 0 0 0

OTC financial and credit derivatives: net fair value by counterparty

31/12/2018 Central Other financial Banks Other entities counterparties companies

A. Financial derivatives 1) Debt securities and interest rates - notional value 46,478,172 37,279,228 16,927,151 640,177 - net positive fair value 103,775 114,669 11,571 - net negative fair value 167,564 639,594 197,323 22,516 2) Equity securities and stock indexes - notional value 0 4,859,776 4,205,465 - net positive fair value 0 37,489 25,321 - net negative fair value 0 35,991 153,689 3) Currencies and gold - notional value 0 19,935,419 2,803,013 1,057,612 - net positive fair value 0 96,971 21,997 956 - net negative fair value 0 45,312 17,358 7,065 4) Goods - notional value 0 1,091 25,390 6,870 - net positive fair value 0 2,325 - net negative fair value 0 2 2,004 5) Other - notional value 0 0 0 0 - net positive fair value 0 0 0 0 - net negative fair value 0 0 0 0 B. Credit derivatives 1) Protection acquired - notional value 125,000 0 0 0 - net positive fair value 857 0 0 0 - net negative fair value 0 0 0 0 2) Protection sold - notional value 0 0 0 0 - net positive fair value 0 0 0 0 - net negative fair value 0 0 0 0

Credit trading derivatives: notional values at end of period

Trading derivatives several subjects Total Categories of transactions single subject (basket)

1. Protection acquired a) Credit default products 125,000 0 125,000 b) Credit spread products 0 0 0 c) Total rate of return swap 0 0 0 d) Other 0 0 0 Total 31/12/2018 125,000 - 125,000

2. Protection sold a) Credit default products 0 0 0 b) Credit spread products 0 0 0 c) Total rate of return swap 0 0 0 d) Other 0 0 0 Total 31/12/2018 - - -

OTC credit trading derivatives - notional values, gross positive and negative fair value by counterparty

31/12/2018 Central Other financial Total Banks Other entities counterparties companies Contracts not falling under netting agreements 1) Protection acquired - notional value 0 0 0 0 - positive fair value 0 0 0 0 - negative fair value 0 0 0 0 2) Protection sold - notional value 0 0 0 0 - positive fair value 0 0 0 0 - negative fair value 0 0 0 0 Contracts falling under netting agreements 1) Protection acquired - notional value 125,000 0 0 0 125,000 - positive fair value 857 0 0 0 857 - negative fair value 0 0 0 0 0 2) Protection sold - notional value 0 0 0 0 0 - positive fair value 0 0 0 0 0 - negative fair value 0 0 0 0 0

Credit hedging derivatives: notional values at end of period

Hedging derivatives several subjects Total Categories of transactions single subject (basket) 1. Protection acquired a) Credit default products 0 0 0 b) Credit spread products 0 0 0 c) Total rate of return swap 0 0 0 d) Other 0 0 0 Total 31/12/2018 - - -

2. Protection sold a) Credit default products 0 0 0 b) Credit spread products 0 0 0 c) Total rate of return swap 0 0 0 d) Other 0 0 0 Total 31/12/2018 - - -

OTC credit hedging derivatives - notional values, gross positive and negative fair value by counterparty

31/12/2018 Central Other financial Total Banks Other entities counterparties companies Contracts not falling under netting agreements 1) Protection acquired - notional value 0 0 0 0 - positive fair value 0 0 0 0 - negative fair value 0 0 0 0 2) Protection sold - notional value 0 0 0 0 - positive fair value 0 0 0 0 - negative fair value 0 0 0 0 Contracts falling under netting agreements 1) Protection acquired - notional value 0 0 0 0 0 - positive fair value 0 0 0 0 0 - negative fair value 0 0 0 0 0 2) Protection sold - notional value 0 0 0 0 0 - positive fair value 0 0 0 0 0 - negative fair value 0 0 0 0 0 EU CCR1 – Analysis of exposure to CCR by approaches applied

Replaceme Future nt cost / potential Effective EAD after Notional Current Multiplier RWAs loan EPE CRM market exposure value

Market value approach 457,033 485,033 781,231 409,871 Original exposure - - - Standardised approach - - IMM (for derivatives and securities financing - - - transactions [SFTs]) - Of which securities - - - financing transactions - Of which DERIVATIVES and transactions with long- - - - term settlement - Of which from agreements for netting - - - between different products Simplified approach for treatment of financial - - collateral guarantees (for SFTs) Integral approach for treatment of financial - 1,450,034 448,611 collateral guarantees (for SFTs) VaR for SFTs Total 858,482

EU CCR2 – Capital requirement for CVA risk

Value of the RWAs exposure

1 Total portfolios subject to the advanced approach 0 0 2 VaR component (including the multiplier 3×) 0 3 SVaR component (including the multiplier 3×) 0 4 Total portfolios subject to the standardised approach 479,726 180,633 EU4 Based on the approach of the original exposure 0 0 5 Total subject to capital requirement for CVA risk 479,726 180,633

EU CCR3 – Standardised approach – Exposures to CCR by type of regulatory portfolio and risk weighting

Risk weighting factor

Exposure classes Total 0% 2% 4% 10% 20% 50% 70% 75% 100% 150% Other

Central administrations or 0 0 0 0 0 0 0 0 11,262 0 0 11,262 central banks Regional administrations or 0 0 0 0 4,237 0 0 0 0 0 0 4,237 local authorities Public bodies 0 0 0 0 0 0 0 0 6 0 0 6 Multilateral development 0 0 0 0 banks International organisations 0 0 0 0 0 Institutions 0 679,267 53,487 0 1,271,406 531,155 0 0 11,376 0 0 2,546,691 Businesses 0 0 0 0 0 10,047 0 0 82,978 611 0 93,635 Retail 0 0 0 0 0 0 0 35 0 0 0 35 Loans to institutions and businesses with a short-term 0 0 0 0 0 0 0 0 0 0 0 0 assessment of creditworthiness Other positions 0 0 0 0 0 0 0 0 93,234 25 0 93,259 Total 0 679,267 53,487 0 1,275,643 541,202 0 35 198,857 635 0 2,749,126

EU CCR4 – IRB approach – Exposures to CCR by type of portfolio and PD scale

Average EAD after Average Number of Average RWA PD scale maturity RWAs CRM PD debtors LGD densities (years)

from 0.00 to < 0.15 3,151 0.10% 121 31.39% 3.40 679 21.54% from 0.15 to < 0.25 8,942 0.22% 248 28.93% 4.00 2,986 33.40% from 0.25 to < 0.50 10,804 0.44% 247 28.92% 4.07 5,104 47.24% from 0.50 to < 0.75 4,822 0.62% 61 25.18% 4.29 2,144 44.47% from 0.75 to < 2.50 28,530 1.59% 470 27.97% 4.25 19,091 66.91%

Businesses: from 2.50 to < 10.00 15,999 5.08% 252 29.03% 4.16 14,495 90.60% SMEs from 10.00 to < 100.00 6,815 25.34% 95 28.41% 4.21 8,850 129.87%

100.00 (default) 31,698 100.00% 45 41.93% - 12,651 39.91% Past due 597 100.00% 3 22.77% - 80 13.42% UtP 30,992 100.00% 39 42.11% - 12,527 40.42% Default 109 100.00% 3 94.72% - 43 39.65% Subtotal 110,760 31.41% 1,539 32.29% 4.15 66,000 59.59%

Average EAD after Average Number of Average RWA PD scale maturity RWAs CRM PD debtors LGD densities (years)

from 0.00 to < 0.15 17,431 0.06% 146 30.90% 3.39 3,388 19.44% from 0.15 to < 0.25 6,440 0.18% 64 30.56% 3.45 2,332 36.22% from 0.25 to < 0.50 17,058 0.38% 92 29.97% 3.49 8,645 50.68% from 0.50 to < 0.75 - 0.00% - 0.00% - - 0.00% from 0.75 to < 2.50 18,502 1.38% 91 31.32% 4.02 16,510 89.23%

Businesses: from 2.50 to < 10.00 21,819 6.22% 45 27.57% 4.07 25,350 116.18% Other from 10.00 to < 100.00 3,900 44.66% 14 28.46% 4.47 6,185 158.57% 100.00 (default) 73 100.00% 3 36.79% - 12 16.36% Past due - 0.00% - 0.00% - - 0.00% UtP 73 100.00% 3 36.79% - 12 16.36% Default - 0.00% - 0.00% - - 0.00% Subtotal 85,223 4.12% 455 29.82% 3.78 62,422 73.25% from 0.00 to < 0.15 991 0.08% 98 31.63% - 51 5.11% from 0.15 to < 0.25 2,445 0.21% 233 29.24% - 239 9.79% from 0.25 to < 0.50 1,652 0.42% 138 28.72% - 249 15.10% from 0.50 to < 0.75 1,344 0.62% 113 28.16% - 250 18.58% from 0.75 to < 2.50 5,614 1.45% 420 28.06% - 1,461 26.02% Retail: from 2.50 to < 10.00 3,578 5.17% 186 28.53% - 1,230 34.38% Other SMEs from 10.00 to < 100.00 1,509 21.39% 113 28.01% - 737 48.85% 100.00 (default) 1,450 100.00% 40 33.31% - 259 17.87% Past due 525 100.00% 6 23.02% - 71 13.45% UtP 884 100.00% 33 37.00% - 174 19.67% Default 42 100.00% 1 84.32% - 15 35.32% Subtotal 18,582 11.09% 1,341 28.97% - 4,476 24.09% from 0.00 to < 0.15 76 0.12% 3 13.82% - 3 4.11% from 0.15 to < 0.25 6 0.20% 1 14.09% - 0 6.06% from 0.25 to < 0.50 20 0.33% 3 14.92% - 2 8.87% from 0.50 to < 0.75 1 0.56% 3 16.72% - 0 13.64% from 0.75 to < 2.50 141 1.80% 5 10.96% - 20 14.10% Retail: from 2.50 to < 10.00 1 4.90% 1 19.23% - 0 30.03% Other non-SMEs from 10.00 to < 100.00 35 27.69% 4 16.00% - 13 38.61% 100.00 (default) 47 100.00% 3 31.67% - 8 17.73% Past due - 0.00% - 0.00% - - 0.00% UtP 39 100.00% 2 24.26% - 6 14.87% Default 8 100.00% 1 69.86% - 2 32.46% Subtotal 327 18.20% 23 15.48% - 47 14.47% Total (all portfolios) 214,893 18.81% 3,358 31.00% 3.95 132,945 61.87%

EU CCR5-A – Impact of netting agreements and of collateral guarantees held on the amount of exposures

Positive gross fair Benefits of Offset current Collateral Net loan value or net book offsetting loan exposure guarantee held exposure value

Derivatives 1,864,757 1,654,789 209,968 225,762 0

SFTs 0 0 0 0 0

Netting between different 0 0 0 0 0 products

Total 1,864,757 1,654,789 209,968 225,762 -

EU CCR5-B – Composition of collateral guarantees for CCR exposures

Collateral guarantee used in derivative transactions Collateral guarantee used in SFTs

Fair value of the collateral Fair value of the collateral Fair value of the Fair value of the guarantee received guarantee provided collateral collateral guarantee guarantee Segregated Not segregated Segregated Not segregated received provided

Derivatives 224,242 1,519 999,932 67,910 0 0

SFTs 0 0 0 0 22,299,802 167,713

Total 224,242 1,519 999,932 67,910 22,299,802 167,713 EU CCR6 – Exposures in credit derivatives

Credit derivatives for hedging Other credit Protection bought Protection sold derivatives

Notional

Single-name credit default swaps 125,000

Index credit default swaps 0

Total return swaps 0

Credit options

Other credit derivatives 0 Total notional 125,000 Fair value 857 Positive fair value (asset) 857 Negative fair value (liability) 0

EU CCR8 – Exposures to CCPs EAD after CRM RWAs 1 Exposures to QCCPs (total) 34,802

Exposures from trading with QCCPs (excluding the initial margin and 2 732,754 15,725 contributions to the guarantee fund); of which:

3 i) derivatives traded over the counter (OTC) 130,762 3,685 4 ii) derivatives traded in markets 17,895 358 5 iii) SFTs 584,096 11,682 6 iv) agreements for netting between different products approved 0 0 7 Segregated initial margin 588,869 8 Non-segregated initial margin 189,609 7,584 9 Pre-funded contributions to the guarantee fund 370,247 11,493 Alternative system for calculating the requirement on the subject of own 10 0 funds 11 Exposures to unqualified CCPs (total) - -

Exposures from trading with unqualified CCPs (excluding the initial margin 12 0 0 and contributions to the guarantee fund); of which:

13 i) derivatives traded over the counter (OTC) 0 0 14 ii) derivatives traded in markets 0 0 15 iii) SFTs 0 0 16 iv) agreements for netting between different products approved 0 0 17 Segregated initial margin 0 18 Non-segregated initial margin 0 0 19 Pre-funded contributions to the guarantee fund 0 0 20 Non-funded contributions to the guarantee fund 0 0 Securitisation and Covered Bond Transactions

Summary of objectives and methods Through the execution of securitisation and covered bond transactions the Group has pursued the following main objectives: diversification of funding sources, reduction of the cost of funding and possible freeing up of capital. Additionally, during 2018 the Group carried out securitisation transactions through the block disposal of loans classified as in default within the context of derisking actions.

In all Group securitisation transactions (with the exception of the default loan securitisation transaction known as Red Sea SPV S.r.l.) the disposing bank maintained the "first loss" through subscription of the junior securities. The senior securities were alternatively placed with institutional investors for all transactions executed before December 2007, or entirely held by the Originator Banks for the other transactions carried out since the 2008 crisis. Securitisations characterised by the full subscription of the securities issued by the Special Purpose Entities (SPE) are called “self-securitisations” and their exclusive purpose is funding, in that senior securities are used to obtain liquidity by means of refinancing transactions with the ECB or through repurchase agreements with market counterparties.

The Group also has three Covered Bond issues ("CB") destined for institutional investors or for repurchase by the issuer for use in retained financing transactions: a structured program issued by the former Banco Popolare (“BP OBG1”) guaranteed by the vehicle BP Covered Bond S.r.l. and two programs issued by the former BPM S.c.ar.l. (“BPM OBG1” and “BPM OBG2”) guaranteed respectively by the vehicles BPM Covered Bond S.r.l. and BPM Covered Bond 2 S.r.l. In all the programmes cited above, Banco BPM acts as the issuer bank for the CBs, as the bank selling the assets (pursuant to article 7-bis of Law 130 of 30 April 1999( and as the lending bank. The securities issued are placed with institutional investors or subscribed by Banco BPM which uses them for refinancing transactions with the European Central Bank or other institutional counterparties.

As at 31 December 2018, the Banco BPM Group had carried out the following securitisation transactions: . BP Mortgages S.r.l. (March 2007): securitisation of performing residential mortgages originated by – SGSP S.p.A., now Banco BPM; . BP Mortgages S.r.l. (June 2007): securitisation of performing residential mortgages originated by S.p.A. and by S.p.A., now Banco BPM; . BPL Mortgages S.r.l. Series V (December 2012-self-securitisation): securitisation of performing residential mortgages originating with Banco Popolare Soc. Coop. and Credito Bergamasco S.p.A. and from Banca Popolare di Milano S.p.A. now Banco BPM; . BPL Mortgages S.r.l. Series VII (June 2014-self-securitisation): securitisation of performing landed-property loans and mortgages and of loans secured by other collateral and personal guarantees disbursed to SMEs by Banco Popolare and by Credito Bergamasco S.p.A., and from Banca Popolare di Milano S.p.A., now Banco BPM; . Italfinance Securitization Vehicle S.r.l. (December 2005): securitisation of performing leases originated by Banca Italease S.p.A., now Banco BPM; . Italfinance Securitization Vehicle 2 S.r.l. (January 2009 - self-securitisation): securitisation of performing leases originated by Banca Italease S.p.A., now Banco BPM; . BPM Securitisation 2 S.r.l. (July 2006): securitisation of residential mortgages originated by Banca Popolare di Milano S.c.a.r.l., now Banco BPM; . ProFamily Securitisation S.r.l. (November 2015 - self-securitisation) securitisation of a portfolio of performing consumer loans originated by ProFamily S.p.A.

The loans underlying these transactions have not been derecognised from the financial statements of the originator bank, but continue to be recorded among “Loans to customers”.

Below are new transactions completed during the year, in the context of derisking projects: . Red Sea SPV S.r.l (Exodus Project) - subject to full derecognition from the financial statements: in June Banco BPM completed the disposal of a portfolio of default loans for a gross nominal value of around 5.1 billion to the vehicle Red Sea SPV S.r.l., through a securitisation transaction within which the senior securities issued as part of the transaction are backed by government guarantees pursuant to Decree Law 18/2016 (GACS), issued by the Ministry of Economy and Finance on 5 September 2018. Banco BPM subscribed the senior securities and holds 5% of the junior and mezzanine securities. . Leviticus SPV S.r.l (Ace Project) – warehousing: on 28 December 2018, the transfer to Leviticus SPV S.r.l. (a vehicle specifically established and not part of the Banco BPM Group) of a portfolio of default loans for a gross value of around 6 billion and of around 1.1 billion net of writeoffs was completed. The nominal value before writeoffs was 7.4 billion, relative to the date of enjoyment established contractually, 30 June 2018. Considering that at 31 December 2018 the cited vehicle had not yet issued the securities, the transaction is classified as in warehousing for the purposes of the financial statements. On 6 February 2019 the transaction was completed through the issuing of securities entirely subscribed by Banco BPM by the vehicle; in the context of the signed agreements, presumably 95% of the junior and mezzanine securities issued by the vehicle will be sold. This involves significant transfer of the risks and benefits associated with the portfolio of loans transferred, and consequent accounting derecognition.

The main risks inherent to securitisation transactions, with the exception of those subject to full derecognition, and those of the CBs can be summarised as: (i) interest rate risk, linked to possible fixed-rate/floating-rate tranches/series on an underlying portfolio of mortgages with different types of rates; (ii) credit risk, attributable to the quality of the loans transferred to the special-purpose entity and, therefore, to their performance; (iii) counterparty risk, consisting in the possibility that the creditworthiness of third party counterparties involved in transactions (swap counterparties, cash managers, account banks etc.) could deteriorate to such an extent as to create a liquidity problem with a consequent negative impact on the ratings of individual tranches/series issued; (iv) reputational risk, consisting of the possibility that a specific event negatively influences the credibility and the image of the group on the reference market (failure to observe the regulatory tests envisaged in the CB programmes, delay in the reporting sent out for external purposes); also the lack of actions by Banco BPM so as to support the operations if it is envisaged that they may negatively influence the Group’s credibility on the market; (v) liquidity risk, linked to the performance of the collateral book: a deterioration in the portfolio securitised or transferred as part of a CB programme may create a shortfall in the transaction’s financial structure and, as a result, the inability of the vehicle to reimburse the securities issued or to pay the interest on the securities in the case of default by the issuer (for CBs), or cause the failure of the regulatory or contractual tests envisaged in the CB programmes.

There is an additional type of risk in the self-securitisations structured by the Group, and the series of CBs repurchased by the Originator and used in monetary policy transactions with the ECB, also linked to the quality of the underlying portfolio. A deterioration in the transferred loans could result in a reduction in the price of the senior tranche by the supervisory authorities in refinancing transactions, as well as a reduction in the rating of the securities also below the minimum threshold for ECB eligibility, with a resulting impact on the value of the portfolio of securities which can be lodged and are eligible and, therefore, on the bank’s liquidity.

In the securitisation transactions carried out (with the exception of those relative to derisking projects), Banco BPM serves as the originator and servicer of the portfolios sold and sometimes as the subordinated lender. he role of Originator involves the transfer of loan books to SPE incorporated under the form of “società per la cartolarizzazione di crediti” (loan securitisation companies) pursuant to Italian Law 130/1999, which finance the purchase of books through the issue of ABS securities.

Furthermore, Banco BPM performs certain specific activities within the securitisation transactions, including the role of “Administrative Servicer”, meaning the party in charge of performing certain accounting and administration services on behalf of the SPE, and, as Interim Account Bank (custodian bank of the SPE’s accounts) with the obligation of transferring the funds credited to current accounts held by the SPE to the Account Bank.

In securitisation transactions, BPL Mortgages S.r.l. Series V and BPL Mortgages VII and with regard to the two CB programmes (BP OBG1 and BPM OBG1), Banco BPM also acts as Custodian Bank, holding several accounts in the names of the relative SPEs.

The Banco BPM Group has arranged a set of periodic assessments to monitor the changes in risks relating to the securitisations and CB programmes. In the area of securitisation transactions, the following are periodically monitored: (i) the performance of the portfolio in terms of levels of default, delinquency and prepayment, and (ii) the levels of ratings of senior and mezzanine tranches.

In the area of Covered Bonds, in addition to periodically monitoring the performance of the portfolio in terms of levels of default, delinquency and prepayment, regulatory tests are conducted as well as those required by the rating agencies, at a greater frequency than set forth in the Programme’s contractual documentation, in order to promptly act to support the transaction, thus avoiding failure of the tests and the related consequences.

For risks relating to securitisations and Covered Bond programmes, Banco BPM has adopted a series of useful mitigation mechanisms. Specifically, to mitigate counterparty risk in the transactions, counterparties with high ratings are involved, and contractual provisions are entered which state that in the event of downgrading of said counterparties, certain guarantees may be given or they may be replaced. Reputational risk, instead, is mitigated by means of effective relations with the market and with institutional investors.

The selection of a high quality loan book, as well as the monitoring and management of transferred loans, along with the level of credit enhancement/overcollaterisation significantly reduce liquidity risk.

Lastly, with regard to interest rate risk, recourse to the signing of derivative contracts, if necessary, protects the SPE from unexpected movements in the interest rate curve, shielding it from interest rate risk.

To calculate risk-weighted exposures for securitisation risks, the Banco BPM Group applies two different approaches, ordered hierarchically:

. if the loan exposures included in the securitised book are subject to the application of the standardised approach, the same approach is likewise applied to the exposure towards the securitisation;

. if the loan exposures included in the securitised book are subject to the application of the advanced approaches based on internal models, the same approach is likewise applied to the exposure towards the securitisation.

The securities issued as part of a securitisation transaction or a CB programme may be:

(i) placed on the market through parties assigned for such purposes in advance (dealers/lead managers, bookrunners, etc.); or

(ii) fully subscribed by the originator of the transferred assets or by the issuer in the case of CB, which will then use the securities in refinancing transactions with market counterparties or in monetary policy transactions with the Eurosystem.

Summary of accounting policies In securitisation transactions, the transfer of financial assets to an SPE, even without recourse, involves the derecognition of such assets only if there is a substantial transfer of risks and rewards.

For securitisations originated by the Group, no derecognition of the loans from the financial statements was carried out when the transaction was executed, even if transferred. This is because the Group has maintained the credit risk associated with the securitised portfolio and the relative rewards, by subscribing the tranche of junior securities, or the securities that bear the risk of the initial losses, or the assumption of similar exposures.

As a result, the loans continue to be recognised in the originator bank’s separate financial statements as “Assets disposed of and not derecognised”; the consideration received from the transfer is recognised as a balancing entry to the recognition of a payable to the SPE, net of the securities subscribed by the bank.

In the consolidated financial statements, the primary effect of the consolidation of the SPE and the relative securitisation assets, if the control requirements established by IFRS 10 are respected, is that the securities issued by the SPE and subscribed by entities not belonging to the Group are included in the statement of financial position.

The following are exceptions to the above general rule:

. the Tiepolo securitisation which nonetheless saw an attempt at closure during the year through (i) the repurchase of the entire residual portfolio at 21 May 2018 and (ii) the derecognition of class C securities still in circulation after the conclusion of the extraordinary payment date on 25 June 2018; . the securitisations performed by the former Italease Group, relative to which the agreements entered into on 24 December 2009 between Banca Italease and Alba Leasing, at the time of the former Banco Popolare Group’s acquisition of control of Banca Italease and the relative reorganisation of leasing activities, resulted in the full derecognition of loans originated by the banking channel, the risks and rewards of which are borne in full by Alba Leasing;

. the Red Sea SPV S.r.l. (Exodus Project) securitisation transaction, subject to full derecognition in the financial statements.

Note that the transfers finalised by the Group did not result in any recognition of profits or losses at the transfer date, as the value of the transferred loans was equal to the book value.

Lastly, all transactions entered into by the Group to date are traditional securitisations. In effect, no synthetic securitisations have been arranged.

Banco BPM Group securitisation transactions Rating agencies involved

Fitch Ratings Ltd BP Mortgages S.r.l (March 2007) Moody's Investors Service Ltd Standard & Poor's Rating Services Fitch Ratings Ltd BP Mortgages S.r.l (June 2007) Moody's Investors Service Ltd Moody's Investors Service Ltd BPL Mortgages S.r.l (December 2012) DBRS Ltd Moody's Investors Service Ltd Italfinance Securitization Vehicle S.r.l (December 2005) Standard & Poor's Rating Services Italfinance Securitization Vehicle 2 S.r.l (III January 2009) Standard & Poor's Rating Services Erice Finance S.r.l (December 2005) Moody's Investors Service Ltd Moody's Investors Service Ltd BPL Mortgages S.r.l. (June 2014) DBRS Ltd Fitch Ratings Ltd BPM Securitisation 2 S.r.l. (July 2006) Moody's Investors Service Ltd Standard & Poor's Rating Services Moody's Investors Service Ltd ProFamily Securitisation S.r.l. (November 2015) DBRS Ltd Moody's Investors Service Ltd Red Sea (June 2018) Scope

Note that for the transactions Italfinance Securitization Vehicle s.r.l. (December 2005) and Italfinance Securitization Vehicle 2 s.r.l. (3 January 2009) the ratings were withdrawn in that the senior securities had been entirely reimbursed.

External rating agencies

For the external rating agencies involved in each securitisation transaction, see the table above.

For the names of the external rating agencies, see the section “Credit risk - Disclosures for portfolios treated under the standardised approach and specialised lending and equity exposures”. Significant changes occurred from the last reference period

BPL Mortgages (June 2014)

In the context of the securitisation transaction “BPL Mortgages 7” carried out in June 2014, in March 2018, within the context of a project to restructure the transaction, the transfer by Banco BPM and Banca Popolare di Milano S.p.A. (now Banco BPM) of an additional portfolio of loans constituted in part by performing loans deriving from the dismantling of the “BPM Securitisation 3” transaction and, for the remaining part, from other mortgage, landed, agricultural and other loans granted to small and medium enterprises.

To finance the acquisition of the portfolio, on 12 April 2018 (the "Increase Date"), the vehicle company increased the nominal value of the asset-backed Series I securities. on the Increase Date, the ratings agency DBRS decreased the rating for the class A1 and A2 senior securities from “AA (high)” to “A” and those of the class B1 and B2 mezzanine securities from “A (high)” to “BBB (high)”, while Moody's confirmed the existing ratings.

Additionally, in December Banco BPM repurchased a portfolio of loans consisting of positions classified as in default as of 30 November 2018.

BPL Mortgages (December 2012)

In March 2018, Banco BPM repurchased a portfolio of loans deriving from mortgages classified as in default through 31 January 2018, while in December it repurchased positions classified as in default as of 30 November 2018.

BP Mortgages (March 2007)

In March 2018, Banco BPM repurchased a portfolio of loans deriving from mortgages classified as in default through 31 January 2018.

Following the downgrading of Italian sovereign debt, on 25 October 2018 Moody's decreased the rating of class A2, B and C securities from “Aa2” to “Aa3”.

BP Mortgages (June 2007)

In March 2018, Banco BPM repurchased a portfolio of loans deriving from mortgages classified as in default through 31 January 2018.

Following the downgrading of Italian sovereign debt, on 25 October 2018 Moody's decreased the rating of class A2, B and C securities from “Aa2” to “Aa3”.

Italfinance Securitisation Vehicle 2 (March 2007)

In October 2018, the securitisation Italfinance Securitisation Vehicle 2 S.r.l. (March 2007) was closed and any securities still existing were reimbursed.

Specifically, on 8 October 2018, Banco BPM and the vehicle Italfinance Securitisation Vehicle 2 s.r.l. signed a contract to repurchase the portfolio of remaining loans deriving from leasing contracts. On 15 October 2018, the SPE reimbursed the outstanding notes, where in particular, the Senior Notes had been subscribed by institutional investors, while the Junior Notes had been subscribed by Banco BPM.

Erice Finance S.r.l. (December 2005)

In June 2018, the securitisation Erice Finance S.r.l. was closed (December 2005). Securities issued within the transaction had been fully reimbursed in September 2016.

On 12 June 2018, Banco BPM and the vehicle Erice Finance S.r.l. had signed a contract to repurchase the portfolio of remaining loans arising from leases.

BPM Securitisation 2 (July 2006)

In October 2018 (i) the agency Moody's had decreased, following the downgrading of Italy, ratings for Class A2 and B securities from "Aa2" to "Aa3" and (ii) the Fitch agency increased the rating of class C securities from “BBB” to “BBB+”.

BPM Securitisation 3 (September 2014)

The BPM Securitisation 3 transaction (September 2014) was closed in March 2018 and outstanding securities were reimbursed.

Specifically, on 1 March 2018 Banca Popolare di Milano S.p.A. and the vehicle BPM Securitisation 3 s.r.l. signed a contract to repurchase the portfolio of remaining loans deriving from leasing contracts. On 8 March 2018, the SPE reimbursed the outstanding notes, where in particular, the Senior Notes had been subscribed by institutional investors, while the Junior Notes had been subscribed by Banco BPM.

Total amount of securitised assets underlying junior securities and other forms of credit support

Traditional Synthetic Losses recognised in QUALITY OF UNDERLYING ASSETS/EXPOSURE securitisations securitisations the period

A. Own underlying assets: 693,953 0 9,113

A.1 Fully derecognised 46,328 0 30

1. Default 0 30

2. Unlikely to pay 0

3. Past due loans 0

4. Other assets 46,328

A.2 Partially derecognised 0 0

A.3 Not derecognised 647,625 0 9,083

1. Default 30,270 0 9,083

2. Unlikely to pay 18,152 0

3. Past due loans 17,735 0

4. Other assets 581,468 0

B. Third-party underlying assets: 0 0 Exposures resulting from securitisations classified by underlying asset quality

CASH EXPOSURES

QUALITY OF UNDERLYING Senior Mezzanine Junior ASSETS/EXPOSURE Gross Gross Gross Net Exposure Net Exposure Net Exposure Exposure Exposure Exposure

With own underlying assets 1,578,170 1,576,546 64,387 64,387 270,386 268,959 a) impaired 1,430,238 1,428,614 2,955 2,955 1,427 b) other 147,932 147,932 61,432 61,432 268,959 268,959

With third-party underlying assets 17,920 17,790 5,651 5,651 36,002 36,002 a) impaired 974 974 b) other 17,920 17,790 4,677 4,677 36,002 36,002

Exposures resulting from main “OWN” securitisations broken down by type of securitised asset and by type of exposure

CASH EXPOSURES

Senior Mezzanine Junior Type of securitised assets / Exposures

Book Adjustments Book Adjustments Book Adjustments value / recoveries value / recoveries value / recoveries

A. Fully derecognised 1,428,614 -1,624 2,955 0 46,328 1,427

A.1 Tiepolo 1 - doubtful loans 1,427

A.2 ITA 8 - performing lease loans 4,778

A.3 ITA 11 - performing lease loans 41,550

A.4 Red Sea - default loans 1,428,614 -1,624 2,955

B. Partially derecognised

C. Not derecognised 147,932 0 61,432 0 222,631 0

BP Mortgages March 2007 - residential C.1 31,684 22,296 47,881 mortgage loans

BP Mortgages June 2007 – residential C.2 84,524 29,060 77,069 mortgage loans

BPM Securitisation 2 - residential mortgage C.3 31,724 10,076 68,536 loans

C.4 ITA 8 - performing lease loans 29,145 Exposures resulting from main “THIRD PARTY” securitisations broken down by type of securitised asset and by type of exposure

CASH EXPOSURES

Senior Mezzanine Junior ISIN / Type of assets securitised / Exposures Adjustment Adjustment Adjustment Book Book s / Book value s / s / value value recoveries recoveries recoveries Mortgage ES0312885017 BANCAJA 6 A2 EUR /36 2,882 -72 0 loans Mortgage IT0005022915 BNT PORT 14-42 TV 0 35,352 loans

IT0004323702 PHARMA FIN.SR3 TV 28 Other 4,486 0 0

IT0005161135 MULTISELLER 16 - 362 Loans 337 0

IT0004323728 PHARMA FIN.SRL TV 28 Other 0 282 0

IT0004323744 PHARMA FIN.EUR TV 28 Other 0 4,395 0

Mortgage ES0338450002 TDA IBERCAJA 35 TV 1,684 -41 0 loans

IT0005318214 BERENICE 13-33 CL.B 6% Other 0 974

IT0005318222 BERENICE 13-33 CL.C TV Other 0 650

IT0005352676 ALBA 10 SPV Other 8,401 -17

Weighted amount of the positions regarding securitisations by risk weighting (STANDARDISED APPROACH)

EXPOSURE Amount EXPOSURE CLASS WEIGHT BANDS Underlying Type TYPE Own Third-Party Average weighting factor pursuant to art. 253 (1) Junior Other assets 0 33,266 CRR 20% Senior Other assets 3,513 100% Senior Other assets 337 Mortgage loans on 1,250% - with ratings Junior residential properties Securitisation Positions Mortgage loans on Senior residential properties Mezzanine Other assets 12,082 1,250% - without ratings Junior Other assets 8,241 Mortgage loans on Junior residential properties Total 57,438 Re-Securitisation 0 exposures Total 0 Total as at 31 December 2018 57,438 Capital requirement of the positions regarding securitisations by risk weighting (STANDARDISED APPROACH)

EXPOSURE Amount EXPOSURE CLASS WEIGHT BANDS Underlying Type TYPE Own Third-Party Average weighting factor pursuant to art. 253 (1) Junior Other assets 0 2,661 CRR 20% Senior Other assets 281 100% Senior Other assets 27 Mortgage loans on 1,250% - with ratings Junior residential 0 0 properties Securitisation Positions Mortgage loans on Senior residential 0 0 properties Mezzanine Other assets 0 967 1,250% - without ratings Junior Other assets 659 Mortgage loans on Junior residential 0 properties Total 4,595 Re-Securitisation 0 exposures Total 0 Total as at 31 December 2018 4,595

Weighted amount of the positions regarding securitisations by risk weighting (IRB RBA APPROACH)

EXPOSURE Amount EXPOSURE CLASS WEIGHT BANDS Underlying Type TYPE Own Third-Party Mortgage loans on residential 7% Senior 0 219 properties 8% Senior Other assets 0 146 Mortgage loans on residential 10% Senior 0 0 properties 20% Senior Other assets 0 0 Securitisation 250% Senior Other assets 0 0 Positions 1,250% - with Junior 0 0 ratings Mezzanine Non performing loans 36,934 0 1,250% - without Mortgage loans on residential ratings Junior 0 0 properties Total 36,934 365 Re-Securitisation 0 0 exposures Total 0 0 Total as at 31 December 2018 36,934 365 Capital requirement of the positions regarding securitisations by risk weighting (IRB - RBA APPROACH)

EXPOSURE Amount EXPOSURE CLASS WEIGHT BANDS Underlying Type TYPE Own Third-Party Mortgage loans on residential 7% Senior 0 18 properties 8% Senior Other assets 0 12 Mortgage loans on residential 10% Senior 0 0 properties 20% Senior Other assets 0 0 Securitisation 250% Senior Other assets 0 0 Positions 1,250% - with Junior 0 0 ratings Mezzanine Non performing loans 2,955 0 1,250% - without Mortgage loans on residential ratings Junior 0 0 properties Total 2,955 29 Re-Securitisation 0 0 exposures Total 0 0 Total as at 31 December 2018 2,955 29

Distribution by type of exposure of the positions weighted at 1,250% (IRB - RBA APPROACH)

31/12/2018 Type of securitised assets / Exposures Own Securitisations of securitisations third parties Non performing loans 36,934 0 Other ABS (CLO/CMO/CFO) 0 0 CDO cash 0 0 CMBS 0 0 SME loans 0 0 Personal loans 0 0 RMBS 0 0 TOTAL EXPOSURES WEIGHTED AT 1,250% 36,934 - Market risk - IMA approach

Characteristics of the internal models and description of the stress tests applied

Internal model Banco BPM, Banca Akros At the beginning of 2012, the Banco BPM Group obtained validation of the internal model for market risks, with effect from 30.06.2012. The internal model is used in association with management risk measures that differ from regulatory measures by virtue of the risk factors considered and some technical elements.

The main characteristics of the VaR internal model used to value market risk from a regulatory and management perspective are set forth below:

 Method: historical simulation  Time horizon: 1 day (re-parameterised to 10 days for regulatory purposes)  Depth of historical series: 1 year  Confidence level: 99%  Decay factor: 0.99 for management purposes and 1 for regulatory purposes (or equal weighting of the historical scenarios of reference)  Non-linearity of pay-outs: managed through an assessment of the portfolio in full evaluation The risk factors considered by the VaR model for regulatory purposes are:

 share prices;  volatility of share prices;  interest rates;  volatility of interest rates;  exchange rates;  volatility of exchange rates. For management purposes, the internal model also estimates the specific risk factor.

The regulations provide for a prudential requirement additional to the VaR, calculated using market inputs related to periods of financial stress ( "Stressed VaR”). The scope of application of the stressed VaR includes all the risk factors in the VaR model for regulatory use.

All positions in the Banca Akros and Banco BPM Trading Book are subjected to measurement of market risk. The Trading Book is identified as all positions present in the portfolios to which was assigned the attribute of portfolio containing transactions for trading purposes. This attribute is assigned when a new portfolio is entered into the Front Office applications by the applicant operator. To this end, there is a specific process rule “Process of opening new position keeping portfolios” which defines the players involved and the activities that each of them must perform for the portfolio to be entered. At the same time, this process guarantees a precise distinction between the Trading Book portfolios and those of the Banking Book. In order to estimate the capital requirement using the internal model, the capital requirement is therefore calculated using the following formula:

Ct  max[VaRt1;β c VaR]  max[sVaRτ ;β s sVaR]  ST par.ill.

C  t : is the capital requirement at day t; VaR  1t : is the value at risk calculated according to the internal model for the book

held at day t-i, while VaR represents the average of the VaR measures calculated in the last 60 business days; sVaR  τ : is the last available value for the Stressed VaR while sVaR represents the average of the Stressed VaR measures calculated in the last 60 business days; β β  c and s : represent the multiplication factors for the VaR and the Stressed VaR respectively; .illparST  : is the component of the capital requirement estimated for illiquid parameters and conducted with stress test methods. These parameters are represented by dividends and correlation. The multiplication factors established for both Banco BPM and Banca Akros are 4.4 for the VaR and the Stressed VaR.

Market risk stress test Stress Tests are tests carried out on a portfolio to identify the scenarios, i.e. the changes in a series of risk factors, the occurrence of which would incur a significant loss.

These tests allow identification of the risk factors that contribute more than others to this negative result and consequently allow implementation of loss-limiting strategies when these scenarios occur.

Stress testing is mandatory for the purposes of validating Internal Models for quantifying minimum capital requirements for the market risk, as it provides banks with indication of the level of capital required to deal with any loss arising from long-lasting deterioration of the economic-financial conditions.

It is also a supporting tool for other risk management and measurement techniques, in that it:  provides a prospective view of risks and their economic impact;  exceeds the limits arising from risk management models based on historical data (HVaR with reading of the last 250 observations);  integrates managerial reporting and public disclosure;  provides input data for capital and liquidity planning processes;  provides indication of a bank’s level of risk tolerance;  guarantees development of risk mitigation and recovery plans in certain stress situations. For the Banco BPM Group, stress tests are carried out regularly for the entire trading book. In order to establish the value of the book in stress scenarios, the full revaluation approach has been chosen to ensure that all irregularities in pay-offs of instruments are fully noted. Two types of scenario are applied: historical scenarios (in which the changes in each risk parameter are consistent with the worst historical observations) and hypothetical scenarios in which the changes in the risk parameters are defined through expert valuation. In order to represent the overall risk associated with a trading book, the link between the market risk and the liquidity risk—specifically in terms of market liquidity risk, that is, the risk which, due to a sudden shortage in market liquidity, a bank is unable to close some positions promptly (at a price approaching the theoretical price)—is of particular importance. The time required to allow timely closing of the risk positions of a trading book is considered to be 10 business days. This horizon is consistent with supervisory recommendations, traders´ opinions and historical quantitative data. Hence, in Stress Test evaluation, when possible scenarios are identified based on 10- day time ranges or, for data concerning daily oscillations in parameters, the VaR data is re- parameterised on a 10-day time horizon.

Backtesting The most important aspect of back testing is the comparison between the values of expected losses (VaR) and the portfolio’s actual or theoretical losses. Once these two comparable figures have been obtained, it is possible to statistically analyse the frequency of exceptions, i.e. of those cases in which the VaR measure estimated by the model proves less serious than the actual loss recorded. The prudential supervisory regulations establish that the change in value of the book (or individual position) must be as significant as possible for comparison with the VaR (not only is a direct comparison between the VaR calculated on a portfolio and its Profit and Loss result of little real value, but it may also lead to incorrect conclusions). The best measure is the actual net change, that is, the measure obtained by excluding commissions and the contribution for accrued interest from the operating results. The back tests are also conducted on the basis of the hypothetical change in the portfolio, obtained by revaluing the quantities present in the portfolio on day t-1 with the day t (test date) prices. Each day, the VaR result is compared with the P&L result, both Actual and Theoretical, as described above, and a report is provided on how the ratio between the two measures has evolved on a historical basis, that is, over the last 250 observations. The Group chose to carry out back testing not only on the banks’ entire portfolio, but also to compare at portfolio sub-aggregates level, the P&L back testing result and the VaR result. This decision was dictated by the intention to check and monitor the performance and reliability of the VaR model results on various levels of the company´s organisational structure, where the result is less influenced by the effects of netting. The decision is also consistent, in management terms, with the attribution of VaR limits on various levels. From an operational point of view, this decision means that it is possible to check the extent to which the model in use is valid for the various portfolios, highlighting those areas in which modelling of the changes in P&L on the basis of historical simulation is more efficient and where it is less. Furthermore, if exceptions should arise, it is possible to precisely identify the individual component that produced the event and therefore to take appropriate action.

Scope of authorisation to use the internal models approach issued by the Bank of Italy At present, the following risk profiles are included in the internal model: generic risk for debt securities, equity securities and UCITS units; specific risk for equity instruments and UCITS units, also prudentially calculating the exchange rate risk which is measured with internal models and also with the standardised approach (double counting). At this stage of the validation process, the internal approach is also adopted for quantifying the risk arising from change in the price of instruments with irregular pay-off (options risk). The table below provides a graphic illustration of the risk profiles that are measured using proprietary models as at the reference date:

Position Risk Foreign Commodity Regulatory Concentration Equity Rate UCITS Options Exchange Risk Risk Risk Gen. Spec. Gen. Spec. Gen. Spec. Risk Banco BPM Akros Bank

Key Standardised reporting Internal model reporting

During 2018, projects were begun to extend the internal model for banking book exchange risk and debt security specific risk.

Fair value policy To ensure increasing clarity, transparency and comparability of data relating to the fair value measurement of financial instruments, for the benefit not only of shareholders but also of all the bank’s stakeholders, the Banco BPM Group has set in place internal rules and an internal policy that provide transparent and comprehensive governance of the methodological approach and operating model adopted by the Bank for the fair value measurement of financial instruments, in compliance with regulations in force (accounting standards, financial statement regulations).

The fair value policy is applied to all valuations made in the Annual Report (Balance Sheet, Income Statement and Explanatory Notes) of financial instruments represented by debt securities, equity instruments and derivatives and concerns the positions of the books owned by Group Banks, excepting third party trading books.

Fair value measurement of financial instruments may occur:

 through use of market prices or values that meet certain requirements ( ‘mark to market’);

 through use of market prices or values of similar instruments or transactions that meet certain requirements ( ‘mark to matrix’);  through use of measurement techniques and models based on market parameters ( ‘mark to model’), whether entirely observable or in part deriving from hypotheses and assumptions.

The best evidence of the fair value of a financial instrument is a price listed on an active market.

If the market is not active and the listed price does not provide a correct representation of the instrument´s fair value, the Bank determines the fair value by adopting a valuation technique.

The valuation technique aims to establish the price at which the transaction would have occurred at the valuation date in normal business conditions.

Valuation techniques take the following into consideration:

 if available, the prices of recent transactions on similar instruments suitably corrected to reflect changes in market conditions and technical differences between the instrument to be valued and the instrument selected as similar ( ‘comparable approach’ or ‘mark to matrix’);

 valuation models commonly used by the financial community that have proven over time to produce reliable estimates of prices with regard to current market conditions.

With regard to the latter type (valuation models), the Bank makes maximum use of observable market parameters reducing as far as possible the input from internal assumptions and/or estimates.

In conducting its assessments with a pricing model, the Bank takes into account all the relevant factors for the purpose of determining a price that may be considered representative of a hypothetical market transaction.

The Bank also periodically conducts a calibration exercise on the valuation techniques to test, on an ongoing basis, their validity with regard to actual market transactions or to any other observable value that is representative of fair value.

Fair value measurement also involves the application of valuation adjustments to take into account the risk premiums considered by the operators when pricing the instruments. If not explicitly considered in the valuation model, the valuation adjustments include:

 model adjustments: to consider the weaknesses of the models highlighted during the calibration phases;

 liquidity adjustments: if the model estimates a mid-price, it must be adjusted to take the bid/ask spread into account;

 credit risk adjustments: if the model does not take the counterparty risk or own risk into account, it must be adjusted accordingly;

 other risk adjustments: if the model does not take a risk premium priced on the market into account (for example, concerning the complexity of valuation or hedging of the instrument), it must be appropriately corrected.

These corrections are permitted only to the extent to which they help to obtain a better estimate. Accordingly, valuation adjustments are not adopted if they distance the valuation from the fair value, for example, merely for prudential purposes. The Fair Value Policy consists of two main documents: a first document describing the procedures and the source of valuation of the Securities and a second document that applies to Derivatives.

The aim of the first document concerning Securities is to define and formalise the Bank´s operating choices for fair value measurement of non-derivative financial instruments.

Specifically, within the Mark-to-Market Policy, the document defines:

 the procedures for choosing the markets from which the prices are taken;

 the configurations of the price adopted;

 the information sources;

 the types of operating controls on availability and quality of prices.

As provided for in the Mark-to-Model Policy, the document describes:

 the criteria for finding market parameters using the comparable approach;

 the market parameters to be used in the technical valuations;

 the operating controls on availability and quality of market data.

The aim of the second document concerning Derivatives is to define and formalise the Bank’s operating choices for fair value measurement of derivative financial instruments. Specifically, within the Mark-to-Market Policy, the document defines:

 the procedures for choosing the markets from which the prices are taken;

 the configurations of the price adopted;

 the information sources.

As provided for in the Mark-to-Model Policy, which includes OTC derivative instruments, the document describes:

 the market parameters to be used in the technical valuations;

 the criteria for finding market parameters using the comparable approach.

Fair Value Policy - Compliance with regulations Compliance with regulations of the Fair Value Policy—validated by the Validation function at the time of application for the validation of the internal model for market risk—is constantly guaranteed by organisational safeguards in place for its process of maintenance and change. More specifically, proposals to change the technical annexes of this document are submitted for the approval of the Parent Company Risk Committee on the proposal of/following an investigation by the Risk Unit, which also considers aspects of prudence and reliability (established by the regulatory legislation) of the assessment approaches proposed.

Pricing models OTC derivative instruments are managed on a specific position keeping application (namely the Risque application of the company Mysis/Sophis) which allows calculation of the fair value, management of positions and risk (calculation of risk Greeks, calculation of VaR, management of cash flows, management and accounting profit and loss account) and preparation of all input to the summary systems (accounting, reporting and credit line used).

The fair value is calculated by associating each product with a pricing model which considers the characteristics of the product and specifically the dynamics of the underlying market variables. For particularly complex products or if the default valuation model of the Risque system is considered insufficient or not appropriate, the pricing models may be integrated with valuation models drawn up by the Financial Engineering Unit of Banca Akros.

In both cases, the models are validated and regularly reviewed by the Market Risks Unit, which is responsible for certifying the correctness of the pricing models for the positions managed within the Risque position keeping system.

Validation of Models The activity of validation arises from the need to use a new pricing model dictated by two different types of needs:

 to make existing product pricing models more market compliant;

 to measure new payouts by Traders.

This activity consists of the following points:

 theoretical analysis of the model

 deterministic payout testing

 payout stress testing

 parameter stress testing

 repricing

 consistency of Greeks

 comparative testing with counterparties’ prices

 drawing up Product/Model Validation report.

If the outcome of all the tests is positive, the Validation report is submitted to the Product Innovation Committee.

Review of the Models Models are reviewed in order to check that previously validated models still reflect the changed market conditions and the review is carried out by repeating the validation tests and adding some consistency tests:  price repeating test using Greeks;  ongoing comparison with the market. EU MR2-A - Market risk under the IMA

31/12/2018 31/12/2018 31/12/2017 31/12/2017

BANCO BPM BANCO BPM Capital Capital RWAs RWAs requirements requirements 1 VaR (the greater between a and b) 144,246 11,540 297,604 23,808 a) VaR previous day (Article 365(1) of CRR (VaRt-1)) 22,353 1,788 115,595 9,248

Average of daily VaR (Article 365(1) of CRR) for the b) previous 60 working days (VaRavg) x multiplication factor 144,246 11,540 297,604 23,808 (mc), pursuant to article 366 of CRR

2 SVaR (the greater between a and b) 841,221 67,298 923,349 73,868 a) Last SVaR (Article 365(2) of CRR (SVaRt-1)) 154,251 12,340 305,396 24,432 Average of daily SVaR (Article 365(2) of CRR) for the b) previous 60 working days (SVaRavg) x multiplication factor 841,221 67,298 923,349 73,868 (ms) (Article 366 of CRR) 6 Total 985,467 78,837 1,220,952 97,676

31/12/2018 31/12/2018 31/12/2017 31/12/2017

BANCAAKROS BANCAAKROS Capital Capital RWAs RWAs requirements requirements 1 VaR (the greater between a and b) 141,565 11,325 71,690 5,735 a) VaR previous day (Article 365(1) of CRR (VaRt-1)) 42,757 3,421 58,118 4,649

Average of daily VaR (Article 365(1) of CRR) for the b) previous 60 working days (VaRavg) x multiplication factor 141,565 11,325 71,690 5,735 (mc), pursuant to article 366 of CRR

2 SVaR (the greater between a and b) 302,403 24,192 191,873 15,350 a) Last SVaR (Article 365(2) of CRR (SVaRt-1)) 74,641 5,971 173,459 13,877

Average of daily SVaR (Article 365(2) of CRR) for the b) previous 60 working days (SVaRavg) x multiplication factor 302,403 24,192 191,873 15,350 (ms) (Article 366 of CRR) 6 Total 443,968 35,517 263,564 21,085

31/12/2018 31/12/2018 31/12/2017 31/12/2017

TOTAL TOTAL Capital Capital RWAs RWAs requirements requirements 1 VaR (the greater between a and b) 285,810 22,865 518,595 41,488 a) VaR previous day (Article 365(1) of CRR (VaRt-1)) 65,110 5,209 90,933 7,275

Average of daily VaR (Article 365(1) of CRR) for the b) previous 60 working days (VaRavg) x multiplication factor 285,810 22,865 518,595 41,488 (mc), pursuant to article 366 of CRR

2 SVaR (the greater between a and b) 1,143,625 91,490 1,553,339 124,267 a) Last SVaR (Article 365(2) of CRR (SVaRt-1)) 228,892 18,311 199,302 15,944

Average of daily SVaR (Article 365(2) of CRR) for the b) previous 60 working days (SVaRavg) x multiplication factor 1,143,625 91,490 1,553,339 124,267 (ms) (Article 366 of CRR) 6 Total 1,429,435 114,355 2,071,934 165,755 EU MR3 - IMA values for trading books

31/12/2018 31/12/2017 31/12/2018 31/12/2017 amounts in millions of euro BANCO BPM BANCO BPM BANCA AKROS BANCA AKROS VaR (10 days, 99%)

Maximum value 5,679 14,257 5,339 1,933

Average value 2,834 5,741 3,083 1,040

Minimum value 1,707 1,994 1,613 845

Value at period-end 1,909 2,426 5,261 845

SVaR (10 days, 99%)

Maximum value 28,029 43,092 7,332 4,824

Average value 15,754 16,356 5,520 2,779

Minimum value 12,118 5,518 4,011 1,659

Value at period-end 12,340 5,553 5,971 2,523

EU MR4 - Comparison of VaR estimates with gains/losses

The outcome of backtesting of the VaR estimates, that is, comparison of the expected loss estimated ex-ante through VaR with the corresponding actual profit and loss figures regarding performance of the regulatory trading book of Banco BPM, and of Banca Akros in the period December 2018 - December 2017.

The components that are not pertinent to the back test, such as commissions and intraday activity, have not been included in the daily profit and loss readings.

In the period examined, the number of exceptions (higher losses than the VaR estimate) is consistent with the level of confidence used (an estimate with 99% confidence level means that an exception occurs in 1% of the residual cases: in 250 business days this result is therefore expected in 2-3 business days).

Banco BPM 3.000.000 Actual Gain/Loss Hypothetical Gain/Loss Daily VaR 2.000.000

1.000.000

0

-1.000.000

-2.000.000

-3.000.000

-4.000.000 Banca Akros

1.500.000 Actual Gain/Loss Hypothetical Gain/Loss Daily VaR

1.000.000

500.000

0

-500.000

-1.000.000

-1.500.000

-2.000.000

* Official regulatory reporting figures relative to the development of Banca Akros during 2018

During 2018 the following overruns were recorded:

Banco BPM : Effective Backtesting : n.4

: Hypothetical Backtesting : n.2

Banca Akros : Effective Backtesting : n.2

: Hypothetical Backtesting : n.3

As the number of variances is greater between those obtained using backtesting based on effective portfolio variations and those based on hypothetical portfolio variations, 4 overruns were recorded for Banco BPM and 3 for Banca Akros. Equity exposures Disclosures for positions in the banking book, not for trading

Exposures differentiated based on objectives pursued and accounting techniques

The classification policies adopted by the Banco BPM Group distinguish between equity investments based on objectives pursued and the nature of the investee:

- Direct equity investments in:

- banking, financial, insurance companies;

- instrument and real estate companies;

- other non-financial businesses;

- Indirect equity investments through third parties.

Below are illustrated A) the objective for which equity instruments classified in the financial statements under the items "Equity investments" and "Financial assets designated at fair value" are held (the latter broken down between those through profit and loss and those through other comprehensive income and B) a description of the relative classification, accounting and measurement criteria.

A) Objectives pursued for equity instruments not included in the trading book

The Business Model adopted by the Group, pursuant to the international accounting standard IFRS 9, calls for a distinction between:

- “Hold to Collect” (HTC): referring to financial assets held with the objective of receiving contractual cashflows, holding the financial instrument to maturity;

- “Hold to Collect & Sell” (HTC&S): referring to financial assets held with the objectives both of receiving contractual cashflows over the course of the asset's life and receiving profits from selling the same;

A1) Hold to collect (HTC)

This item includes interests in companies subject to joint control and associates, held for strategic or institutional purposes or instrumental to the Group’s core business and to the development of commercial activity and financial investment.

Joint ventures are investees in which the sharing of control is contractually established with other investors, that is when for financial, management and strategic decisions relative to the company, unanimous consent from all those sharing control is required.

Associated companies are non-controlled companies over which significant influence is exercised. It is presumed that the company exercises significant influence in all cases in which it holds a 20% or higher portion of voting rights and, regardless of the stake held, when it has the power to participate in management and financial decisions of the investees without, however, having control.

A2) Hold to collect and Sell (HTCS)

This category includes financial assets not designated as loans, assets held for trading or assets held to maturity. This category also includes shareholdings that are not held for trading and do not qualify as investments in subsidiaries, associates and entities under joint control.

In addition to directly investing in companies' share capital, the Banco BPM Group holds investments in private equity funds and in similar investment vehicles (UCITS, SICAV, FIA or other similar structures) with the objective of investing in equity or similar instruments, through interposed entities.

These are investments in units of funds other than open harmonised ones (and hence mainly closed funds, for example private equity, private debt and venture capital funds) held with the objective of indirectly participating in the equity of companies, with lasting investment purposes, intended to achieve economic gains over the medium/long-term.

In line with the guidelines regarding Business Models pursuant to international accounting standard IFRS 9, these investments are classified, in the context of financial assets obligatorily designated at fair value (banking book), which represents a residual category and consists of financial instruments that do not meet the requirements in terms of business model or cashflow characteristics for classification among assets designated at amortised cost or at fair value through other comprehensive: these are units of UCITS for which the contractual terms do not envisage solely payments of principal and interest (those which do not pass the SPPI test).

B) Accounting and measurement of equity instruments not included in the trading book

The book value of equity instruments is determined at the time of acquisition and periodically updated, in particular at the time of public disclosures in line with the international IAS/IFRS accounting standards and internal regulations on the subject.

Determining initial book value

Equity investments are recognised for accounting purposes at cost, including any goodwill paid at the time of acquisition, which is therefore not subject to independent and separate recognition.

Financial assets designated at fair value are recognised at fair value at initial recognition, normally corresponding to the transaction price.

For instruments measured at fair value other than those through profit and loss, the initial value is adjusted to take into account any transaction costs directly attributable to the acquisition of the financial asset. For financial instruments designated at fair value through profit and loss, transaction costs and proceeds are accounted for in the income statement when the asset is initially recognised.

For investments in equity funds, initial recognition occurs at the settlement date for the UCITS units and they are recognised at fair value when initially recognised. This normally corresponds to the fees paid, without considering transaction costs or proceeds directly attributable to the financial instrument, which are recognised in the income statement.

Periodical updating of book value

For equity investments, estimation of the recoverable value (impairment test) is done only when there is objective evidence of a decrease in value such as to compromise the recoverability of the investment.

The recoverable value is the greater between fair value, net of sales costs, and the value in use. Value in use is determined by discounting future cashflows the equity investment may generate, including the value of the final disposal of the investment.

Impairment is recognised in the income statement when the book value, including goodwill, is lower than the recoverable value. If the reasons for an impairment loss are no longer valid due to an event occurring after the impairment was recognised, recoveries are recognised in the income statement, to the extent of the impairment previously recognised.

After initial recognition, financial assets designated at fair value are subject to measurement, based on the accounting category in which the financial instrument is classified:

. at fair value through other comprehensive income;

. or at fair value through profit and loss.

Assets classified as "financial assets designated at fair value through profit and loss" are measured at fair value and gains and losses consequent to this measurement are recognised in the income statement (including those consequent to derecognition of the assets - e.g. sales and reimbursements). There are no requirements regarding recognition of impairment, given that any losses in value are already implicit in the fair value measurement of the instrument.

Assets classified as "financial assets designated at fair value through other comprehensive income" are also subject to remeasurement at fair value.

However, profits and losses, whether consequent to the fair value measurement or realised due to derecognition of the financial asset, must be recognised in the statement of other comprehensive income and registered in a specific shareholders' equity reserve.

The amounts recognised in equity reserves, including exchange effects, are never subject to transfer to the income statement.

However, it is possible to transfer them to another equity reserve (e.g. profit reserve) upon derecognition of the asset. The assets in question are not subject to impairment requirements and hence any writedowns are recognised in the equity reserve.

Periodic estimation of the fair value of financial instruments is done on the basis of the hierarchy of criteria established in the IAS/IFRS standards, attributing the highest priority to listed prices on active markets (level 1), and the lowest priority to the use of data not observable on markets (level 3), as these are the result of estimates and assumptions on the part of the evaluator. Below are the details of each level, on the basis of the source and quality of the input used:  Level 1: input consists of listed prices (not adjusted) on active markets for identical assets and liabilities. A market is considered active when the listed prices express effective and regular market transactions and are readily and regularly available through stock markets, brokers, mediators, companies in the sector, listing services or authorised entities;

 Level 2: input consists of:

- prices listed on active markets for similar assets and liabilities;

- prices listed on non-active markets for identical or similar assets and liabilities;

- parameters observable on the market or corroborated by market data (e.g. interest rates, credit spreads, implicit volatility, exchange rates) and used in the measurement technique;

 Level 3: the input used is not observable on the market.

In the absence of an active market, unlisted equity securities are assessed by referring to direct transactions in the same security observed over an equal period of time with respect to the assessment date, or by applying the market multiples method and, subordinately, using financial, income and equity assessment methods.

For the purposes of fair value measurement of investments in investment funds, on the basis of the fair value hierarchy defined in IFRS 13, these are classified as level 3 due to the absence of prices directly observable on markets deemed active.

Measurement of the investments in question, in line with that established in the Group's Fair Value Policy (which includes the Mark to Model Policy, as it is different from open harmonised ones), is done on the basis of the most recent available NAV made available by the fund administrator or management company, adjusted if necessary to take into account events not included in the measurement of the unit or to reflect a different value of the assets underlying the fund in question.

Equity exposures - type and amount

31/12/2018 31/12/2017

REGULATORY PORTFOLIO WEIGHTED AMOUNT WEIGHTED AMOUNT STANDARDISED STANDARDISED IRB APPROACH IRB APPROACH APPROACH APPROACH Exposures traded on the market 301,422 0 301,472 0

Private equity instrument exposures 0 0 0 0

Other exposures 3,490,412 0 5,273,088 0

Total Exposures 3,791,834 0 5,574,561 0 Banking book: cash exposures in equity instruments

31/12/2018 Unrealised Profits/losses capital Market Book value FAIR VALUE realised and gains/losses TYPE OF EXPOSURES/VALUES value impairment recorded in the BS Level Gains Losses Level 1 Level 2/3 Level 1 Level 1 Profits Losses 2/3 (+) (-)

A. Equity investments (*) 0 1,523,997 0 X 0 318,499 X X

B. Financial assets designated at fair value through other comprehensive 177,954 318,879 177,954 318,879 177,954 X X 27,812 -194,285 income

C. Financial assets obligatorily 129,556 578,206 129,556 578,206 129,556 57,244 -37,767 X X designated at fair value

(*) The fair value refers only to the listed equity investments (level 1) Operational risk

Approach used to calculate capital requirements For the purposes of determining capital relative to operational risk, the Banco BPM Group has been authorised by the ECB to use the following regulatory approaches:

a) advanced approach (AMA) for the former Banco Popolare segments already validated for the use of these approaches (former Banco Popolare segments of the Parent Company, Banca Aletti including the private segments transferred to Banca Akros and from the former BPM SpA), SGS BP and BP Property Management

b) standardised approach (TSA) for the former BPM segments already validated for the use of these approaches (former Parent Company BPM Scarl and former BPM SpA segments transferred to the new parent company, Banca Akros including the Corporate and Investment Banking segments transferred to Banca Aletti), ProFamily

c) basic indicator approach (BIA) for the Group’s other minor companies

The AMA model has been developed in such a way as to use all four types of input envisaged by supervisory regulations.

The previous losses recognised internally are gathered by means of a rigorous Loss Data Collection process.

External loss data is provided by the DIPO consortium.

Scenario analyses are gathered during the Risk Self-Assessment (RSA) process, during which various business experts are asked to give their opinions on the exposure of all company processes to operational risk, also with a view to the future. Aspects of the operating context and of the system of internal control are continually monitored in order to promptly recognise changes in the internal and external scenario.

Lastly, note that, from a prudential perspective, the Group does not use mechanisms to reduce pillar I capital, as envisaged in the Regulations, in relation to risk outsourcing/transfer mechanisms such as for example insurance covers or other similar techniques.

The Group’s total Capital at Risk (CaR) is calculated by combining the measurement of risk obtained from the model based on previous operating losses, both internal and external, with that obtained on the basis of the model that uses evidence from scenario analyses.

Both models adopt the modelling approach known as the Loss Distribution Approach, which is based on modelling annual aggregated loss, defined as the sum of the loss amounts (severity) associated with each of the loss events that occur in one year (frequency).

The risk estimate is conducted by means of a Value at Risk measurement, with a confidence interval of 99.9% and over a time horizon of one year on risk classes that demonstrate similar operating losses.

The total capital requirement is obtained by aggregating the risk estimates measured for the various classes of risk, taking into account any benefits of diversifying exposure to the different types of operational risk, and envisages the deduction of the provisions transferred to the income statement, to the extent of the expected loss calculated by the internal model.

Under the Traditional Standardised Approach (TSA) capital requirements are calculated by applying ratios differentiated by business line (which varies between 12% and 18%) to the average of the relevant indicator defined by the CRR 2013/575 for the last three years, broken down by business line.

Under the Basic Indicator Approach (BIA), capital requirements are calculated by applying an alpha coefficient (15%) to the average of the relevant indicator defined by the CRR 2013/575 for the last three years.

The portion of regulatory capital requirements determined using the AMA approach represents 52.2% (equal to around € 243.5 mln out of a total of around € 469.8 mln) of total requirements for operational risk.

Below is a detailed analysis of the AMA, TSA and BIA capital requirement as at 31 December 2018.

VaR AMA No. Event type 31/12/2018 31/12/2017

(mln €) (mln €)

1 Internal fraud 9.5 13.1

2 External fraud 63.4 25.2

3 Relations with personnel and safety in the workplace 4.4 7.0

4 Customers, products and professional practices 196.3 175.1

5 Damages from external events 2.1 2.5

6 Interruption of operations and system malfunctions 1.9 2.0

7 Execution, delivery and management of processes 35.6 45.4

Total Requirement of Risk Categories (A1) 313.0 270.3

Expected loss deduction (A2) 67.7 50.1

AMA capital requirement (A = A1 - A2) 245.3 220.2

TSA requirement (B) 213.6 214.6

BIA requirement (C) 10.9 13.2

Total capital requirement (A+B+C) 469.8 448.1 Breakdown of the capital requirement relating to the AMA approach by event type

1% 4% InternalFrodi fraud interne 1% 9% ExternalFrodi fraud esterne

25% RelationsRapporti with con personnel il personale and e safetysicurezza in the workplace sul lavoro Customers,Clienti, prodotti products e andprassi professionalprofessionali practices 1% DamagesDanni da from eventi external esterni events

59% InterruptionInterruzione of operations dell'operatività and systeme disfunzioni malfunctions dei sistemi

Execution,Esecuzione, delivery consegna and e managementgestione dei of processi processes Interest rate risk on positions in the banking book

Nature of the risk, underlying assumptions and frequency of measurement Interest rate risk assumed by the Banco BPM Group in correlation with its banking book is mainly associated with the core activity performed by the bank acting as an intermediary in the process of transformation of maturities. In particular, the issue of fixed rate bonds, the granting of fixed rate commercial loans and mortgages and funding from demand checking accounts represent a fair value interest rate risk; floating rate financial assets and liabilities represent a cash flow interest rate risk.

The Group has identified its risk appetite and set up a system of prudential limits also for interest rate risk on the banking book, specifically approved by the relevant corporate bodies, to contain the impact of any sudden rise or drop in market interest rates or - for equity - market volatility, on the interest margin and on the value of equity within the defined limits.

The Interest Rate Risks Function of the Parent Company Risk Models unit is in charge of measuring and controlling this risk, also on behalf of the banks and of the main financial subsidiaries.

The structure responsible for managing interest rate risk is the ALM of the Parent Company Finance Department, which carries out this task also on behalf of the banks and financial subsidiaries, and pursues the maximisation of the economic return from the bank’s commercial activity in compliance with the set interest rate risk exposure limits.

In order to reduce exposure to interest rate risk generated by assets, the Group has also implemented fair value hedging of portfolios of similar mortgages and of Core demand items by means of swaps.

To assess interest rate risk on the banking book and subsequent equity absorption, a variance- covariance VaR methodology is used by the Group, over a 12-month holding period, with a confidence level of 99.9%.

The items in the banking book, considered at consolidated level, are mapped to a series of risk factors represented by individual buckets of the forward interest rate structure for both the Euro and foreign currencies. Based on the volatility matrix and correlation between the individual buckets, the maximum expected impairment in the banking book is estimated.

The banking book also includes on demand items and those valid until cancelled, which are the subject of replicating portfolio statistical behavioural modelling (with mean life parameters) through which they are financially represented as equivalent to two portfolios of term deposits, one fixed rate and the other floating rate.

More specifically, in order to represent the particular characteristics of the persistence over time of the volumes and the partial or non-immediate reactivity of the interest rates of these items when market conditions change, two sub-models have been developed: the first to analyse volumes, which enables the stable component of the aggregate of the demand items to be represented as a portfolio of amortising term items (the latter is also estimated by the model), and the second to analyse the interest rates, which enables both the component that reacts to changes in market parameters to be identified (usually Euribor rates) and the adjustment to equilibrium to be measured (viscosity effect).

An additional statistical behavioural model enables the risk of early termination of the portfolio of mortgage loans (prepayment) to be taken into account, measured using a “survival analysis” approach, on the basis of which, a prepayment probability is estimated for each mortgage loan which, applied to the contractual amortisation profile, enables a behavioural amortisation profile to be obtained, corrected to consider the probability of the mortgage loan being terminated.

Moreover, for bonds issued by the Group on the institutional market containing early redemption clauses (which can be exercised exclusively by the issuer), the financial maturity used to estimate interest rate risk is defined by assuming that the clause is always exercised (not, on the contrary, assuming that the loan will be redeemed at its natural maturity).

Monitoring and control is performed on a monthly basis also verifying compliance with the limits for changes in interest margin or equity.

The interest rate risk of the banking book of the Group, monitored by means of the sensitivity indicators, recorded the levels shown in the table below.

Change in the margin and economic value in the hypothesis of shocks on rates

Financial margin Economic value

+40bps -40bps +200bps -200bps

Euro 157,590 -114,797 214,542 -532,407

Other currencies 7,393 -7,197 -246,454 271,039

Total as at 31 December 2018 164,983 -121,994 -31,912 -261,368

The Group makes use of an Asset & Liability Management procedure (ALM) for monthly measurement of “sensitivity” to changes in the interest rate structure on the expected financial margin and on the economic value of capital related to the banking and trading books.

With regard to the expected financial margin, the ALM system estimates its changes on a twelve month horizon (yearly) on the assumption of deterministic shocks of the floating interest rate curves in relation to their level (currently, in relation to the low level achieved by the market rates over the short-term, +/- 40 basis points applied to all the interest rate curves as if it were a sudden, single and parallel change).

Estimates are based - from a static analysis viewpoint - on the assumption therefore that the capital structure remains unchanged in terms of aggregate assets and liabilities, as well as in terms of financial characteristics (rates, spreads, duration).

With regard to the economic value of capital, the ALM system applies assumptions on interest rate curve changes, but with a +/- 200 b.p. shock, measuring the change in current value of all transactions and comparing these changes with the economic value of capital.

In the case of a market scenario characterised by persistent negative interest rates on short- term maturities, a floor on the reduction of the interest rates envisaged by EBA Guidelines is applied to the interest rate sensitivity analyses.

As mentioned earlier, for management purposes, the assessment of capital adequacy also includes an estimated VaR measurement, using a variance/covariance approach, a time horizon of 12 months and a confidence level of 99.9%. Liquidity - Liquidity Coverage ratio

The Banco BPM Group, as more extensively illustrated in the section on risk management objectives and policies, monitors and assesses the adequacy of the exposure to liquidity and funding risk from a current and future perspective, and under the assumption of stress scenarios, using both regulatory metrics (Pillar I regulatory perspective) and internal metrics (internal perspective) defined on the basis of the specific characteristics of the Banco BPM Group and complementary to regulatory metrics.

These internal metrics include, for example, the survival period, the structural gap ratios and other ratios that seek to capture other aspects of liquidity risk such as for example the level of concentration of funding.

The adequacy of the risk profile is assessed and monitored continuously with respect to the liquidity risk appetite stated by the Group in the objectives and risk limits of the Risk Appetite Framework.

In 2018, the liquidity profile of the Banco BPM Group was considered adequate both in the short and long term, respecting the risk limits envisaged both internally and, where present, at regulatory level (LCR, NSFR).

In particular, as regards the regulatory metrics LCR and NSFR, both ratios maintained levels that were comfortably higher than the regulatory minimums.

The Liquidity Coverage ratio (LCR) - seeks to promote the short-term resilience of the bank’s liquidity risk profile, by ensuring that it has sufficient high quality liquid reserves to cover cash outflows for one month in the event of a severe stress scenario.

The ratio is monitored internally on a daily basis and is also reported on a monthly basis to the Supervisory Authority though supervisory reporting.

In accordance with the obligations to publish information on the LCR, in force from 31 December 2017, the following table shows the average value for the past 12 months of the LCR ratio and the main aggregates that comprise it.

Banco BPM Group Total weighted amount (in millions of euro) (average) Figures as at 31 December 2018 31 December 2018

Number of observations used to calculate the average figure 12 TOTAL HIGH QUALITY LIQUID ASSETS 20,485 TOTAL CASH OUTFLOWS 19,646 TOTAL CASH INFLOWS 5,388 TOTAL NET CASH OUTFLOWS 14,257

LIQUIDITY COVERAGE RATIO (%) 143.7% The figures show how the average level of the LCR in 2018 was 143.7%, comfortably higher than the regulatory minimum requirement, with an average level of high quality available liquid assets of € 20.5 billion, 99% of which comprised by the most liquid type (Level 1) of assets eligible for the numerator of the LCR according to Delegated Regulation (EU) 2015/61 of the Commission dated 10 October 2014. More specifically, the rules for calculating the LCR subdivide high quality liquid assets into three categories, considered within the regulations in decreasing order of their liquidity: “level 1", "level 2A" and "level 2B". Increasing haircuts are applied to these haircuts, as well as limits in terms of composition.

In addition to these high quality liquid assets (HQLA), the Group has addition free marketable assets which at 31 December 2018 were estimated as equal to around € 2.7 billion, after application of haircuts to take liquidability into account.

Net cash outflows are calculated by applying regulatory outflow and inflow factors to demand assets and liabilities or those maturing within 30 days so as to serve as a standardised stress test involving both system and idiosyncratic elements.

Below are details on the average value of the aggregates underlying the determination of net cash outflows. For more information, please see the regulations in effect with regards to calculating the LCR, Delegated Regulation (EU) 2015/61 of the Commission dated 10 October 2014.

EU LIQ1 – Information table on Liquidity Coverage Ratio (LCR)

Banco BPM Group Total non Total weighted weighted amount amount (in millions of euro) (average) (average) 31 December 31 December Figure at end of quarter of reference 2018 2018 Number of observations used to calculate the average figure 12 12 High quality liquid assets 1 Total high quality liquid assets (HQLA) 20,485 CASH OUTFLOWS Retail deposits and deposits from small business 2 59,209 4,127 customers, of which: 3 Stable deposits 42,411 2,121 4 Less stable deposits 16,754 1,963 5 Non-guaranteed wholesale funding, of which: 21,254 11,092 Operating deposits (all counterparties) and deposits 4,526 1,114 6 within networks of cooperative banks 7 Non-operating deposits (all counterparties) 16,560 9,809 8 Non-guaranteed debt securities 169 169 9 Guaranteed wholesale funding 156 10 Additional requirements, of which: 11,161 4,027 Outflows for derivative transactions and other obligations 11 3,227 3,227 relative to the provision of guarantees Outflows connected to loss of financing on 12 6 6 debt products 13 Credit and liquidity lines 7,928 795 14 Other contractual financing obligations 244 244 15 Other financing obligations 45,005 - 16 TOTAL CASH OUTFLOWS 19,646 Banco BPM Group Total non Total weighted weighted amount amount (in millions of euro) (average) (average) 31 December 31 December Figures as at 31 December 2018 2018 2018 Number of observations used to calculate the average figure 12 12 CASH INFLOWS Guaranteed loans (e.g. repurchase agreements 5,651 39 17 receivable) 18 Inflows from fully performing exposures 1,910 1,247 19 Other cash inflows 18,471 4,102 20 TOTAL CASH INFLOWS 26,031 5,388

EU LIQ1 – Qualitative information In the Banco BPM Group, as illustrated in the section on risk management objectives and management policies, liquidity management is centralised in the Parent Company, which also serves as the lender of last resort for its subsidiaries. To that end, specifically with reference to the LCR, note that in the last quarter of 2018 the European Central Bank accepted the request to obtain exoneration from individual compliance with the LCR at the level of the individual legal entities and the relative reporting requirements.

The liquidity identification and risk measurement framework includes additional safeguards, complementary to regulatory requirements. Among these we note:

- periodic monitoring aimed at verifying the significant of exposures in currencies other than the euro. At 31 December 2018 there were no significant exposures8 in currencies other than the euro;

- monthly monitoring of excessive concentration risk relative to founding sources. Specific risk limits are placed on unsecured demand funding relative to individual funding providers, on the total of the top ten counterparties and the position on the short-term interbank market; periodic stress tests on the infra-daily liquidity profile, short-term liquidity profile and medium/long-term funding profile. In this area, stress scenarios and sensitivity analyses are defined on the basis of the results of the internal process used to identify risk factors. Analysis performs includes, for example, risks deriving from derivative transactions, from potential collateral calls and from potential unexpected requirements deriving from the operations of the group's customers. This analysis is done making use of historical evidence as well as models developed internally and updated periodically.

8 Significance is identified in the case of liabilities in individual currencies exceeding 5% of total liabilities. Encumbered assets

Main types of encumbered assets

The main types of encumbered assets are: . residential mortgage and landed loans and commercial mortgage loans originated by Banco BPM, used as collateral in the Group’s CB Programmes;

. residential mortgage and landed loans originated by Banco BPM assigned as part of “RMBS” and “SME” securitisation transactions and performing lease agreements originated by the former Banca Italease S.p.A. (now Banco BPM) assigned as part of securitisation transactions;

. commercial and residential mortgage and unsecured loans used for Central Bank refinancing operations (ABACO);

. securities used for short-term borrowing transactions with the Cassa Compensazione e Garanzia (CC&G - settlement and clearing house) and other market counterparties.

The main types of encumbered assets are represented by loans and by debt securities recognised in the Financial Statements. The debt securities, mainly Italian Government securities are used as collateral to raise funds in the short term through repurchase agreements. Instead, the loans are used as collateral or as the underlying assets of longer- term financing arrangements such as, respectively, the issue of CB or securitisation transactions. The remaining part of the encumbered loans is used as collateral for financial operations in place with the Central Bank.

Unencumbered assets are mainly represented by loans and debt securities. Both types of assets can potentially be used as collateral in the main transactions listed above.

The use of collateral in financial transactions requires that the value of the encumbered loans is higher than the amount of the funds raised. More specifically, under CB issue Programmes, it is envisaged that a portion of the additional portfolio is maintained as collateral for the CB issued in order to guarantee a certain level of over-collateralisation. The loans portfolio underlying the CB Programmes is weighted, in order to take into account any write-down/revaluation of the asset securing the transferred mortgage loans and the performance of those loans, also considering any cash reserves present in the SPE and the loan reserves required by the rating agencies to hedge set off9, commingling10 and negative carry risks. Comparing the value of the portfolio and of the reserves with the amount of the CB, the Programme’s credit support is obtained, which provides an indication of the effective level of over-collateralisation.

For securitisations, the rating agencies require a “credit enhancement” constituted by junior securities and cash reserves agreed upon when the various transactions are structured.

9The risk that the SPE may not receive all or part of the collections deriving from loan repayment due to the offsetting of receivables due from assigned debtors from the relative Originator. 10The risk that the SPE may not receive all or part of the loan repayment instalments already collected by the Originator in its role as servicer, but not yet transferred to the SPE, as a result of the servicer being subject to bankruptcy procedures. In addition, also as regards the loans and securities used as collateral in refinancing operations with the Central Bank, with the Cassa di Compensazione e Garanzia and with other market counterparties, haircuts are applied to the value of the encumbered loans and securities.

Quantitative disclosure on encumbered/unencumbered assets Quantitative information relating to encumbered and unencumbered assets is provided below in accordance with the European Central Bank template, in keeping with the provisions pursuant to Part 8, Title II of Regulation (EU) 575/2013 (Technical criteria on transparency and disclosure).

Note that starting from the present disclosure, the values shown are calculated on the basis of the median of the quarterly figures being reported (Template A-Assets - Median values).

Template A-Assets - Median values Carrying Carrying Fair value of Fair value of amount of amount of encumbered unencumbered encumbered unencumbered assets assets assets assets Assets of the reporting institution 55,894,101 106,675,057 Equity instruments 301,194 300,330 1,862,564 1,863,429 Debt securities 19,701,276 19,649,013 15,048,490 14,773,612 Other assets 35,910,482 90,260,888

Template B-Collateral received - Median values Fair value of collateral Fair value of encumbered received or own debt collateral received or own securities issued available for debt securities issued encumbrance Collateral received by the reporting institution 3,505,757 9,493,393 Equity instruments 573,232 237,810 Debt securities 2,882,792 9,345,514 Other collateral received Own debt securities issued other than own covered bonds or ABSs

Template C-Encumbered assets/collateral received and associated liabilities - Median values

Assets, collateral received Matching liabilities, and own debt securities contingent liabilities or issued other than covered securities lent bonds and ABSs encumbered

Book value of selected financial liabilities 43,177,649 55,614,617

To allow for comparison with the previous year, on this occasion the tables containing the specific values identified at 31 December 2018 are provided (Template A-Assets – Specific values). Template A-Assets - Specific values Carrying Carrying Fair value of Fair value of amount of amount of encumbered unencumbered encumbered unencumbered assets assets assets assets Assets of the reporting institution 54,191,349 106,148,122 Equity instruments 266,306 266,306 1,546,150 1,546,150 Debt securities 18,575,905 18,457,217 15,730,000 15,669,790 Other assets 35,349,138 88,871,972

Template B-Collateral received - Specific values Fair value of collateral Fair value of encumbered received or own debt collateral received or own securities issued available for debt securities issued encumbrance Collateral received by the reporting institution 2,885,878 10,022,635 Equity instruments 499,901 - Debt securities 2,385,977 10,022,635 Other collateral received Own debt securities issued other than own covered bonds or ABSs

Template C-Encumbered assets/collateral received and associated liabilities - Specific values Assets, collateral received Matching liabilities, and own debt securities contingent liabilities or issued other than covered securities lent bonds and ABSs encumbered Book value of selected financial liabilities 44,011,747 53,937,779

Encumbrance ratio trend Below are the changes seen in the current year relative to calculation of the Asset Encumbrance Ratio. On this occasion, to allow for comparison with the previous year, two schedules are provided. The first shows the ratio between encumbered assets and total assets, while in the second the calculation includes collateral received.

Encumbrance ratio (without collateral) 31/03/2018 30/06/2018 30/09/2018 31/12/2018 Encumbered assets 55,401,371 56,386,830 58,310,488 54,191,349 Total assets 162,603,363 166,851,689 163,730,497 160,339,471 Encumbrance Ratio (without collateral) 34.1% 33.8% 35.6% 33.8%

Encumbrance ratio 31/03/2018 30/06/2018 30/09/2018 31/12/2018 Encumbered assets 55,401,371 56,386,830 58,310,488 54,191,349 Encumbered collateral 4,125,636 5,134,583 2,712,155 2,885,878 Encumbered assets and collateral 59,527,007 61,521,413 61,022,643 57,077,227 Total assets and collateral 179,718,752 180,950,422 173,628,111 173,247,984 Encumbrance Ratio 33.1% 34.0% 35.1% 32.9% The most significant change in encumbered assets during the year was seen during the last quarter. This decrease is mainly due to the sale of government debt securities. Financial Leverage

Definition and regulatory framework Part Two, chapter 12, of Circular no. 285 of 17 December 2013 "Regulations for the supervision of banks" requires Banks to calculate the leverage ratio as established in Part Seven of Regulation (EU) no. 575/2013 of the European Parliament and of the Council of 26 June 2013, on prudential requirements for credit institutions and investment firms.

This indicator must be measured and monitored over time in order to:

 limit the accumulation of financial leverage and therefore attenuate the brusque deleveraging processes that took place during the crisis;

 limit possible measurement errors associated with the current system for calculating weighted assets.

In fact, the definition of excessive financial leverage risk set forth in the aforementioned Circular (derived from the definitions of art. 4(93) and 4(94) of the CRR Regulation) reads:

"this is the risk that a particularly high level of debt with respect to own funds could make the bank vulnerable, requiring it to take corrective measures in its business plan, including selling assets at a loss, which could require recognizing value adjustments on other assets as well."

The leverage ratio is calculated as the intermediary´s capital (numerator) divided by the amount of the bank´s overall exposure (denominator), and is expressed as a percentage.

Tier 1 Capital Leverage ratio = Amount of overall exposure

The Risk Unit is responsible for monitoring the actual leverage ratio compared to the proposed minimum threshold of 3%. It should be noted in particular that this indicator is included among the Strategic indicators in the Group’s Risk Appetite Framework; hence it is subject to a continuous control and verification of compliance with the defined thresholds (Trigger, Tolerance, Capacity, as well as the Target threshold, which corresponds to the level set in the Business Plan).

The Group currently calculates the leverage ratio based on procedures set forth in Annex XI of Execution Regulation (EU) 680/2014 of 16 April 2014 which, starting from the reporting date 30 September 2016, implements the following regulatory changes:

1) Commission Delegated Regulation (EU) 2015/62 dated 10 October 2014, which amends Art. 429 of Regulation (EU) No 575/2013.

2) Commission Implementing Regulation (EU) 2016/428 dated 23 March 2016, which amends Implementing Regulation (EU) No 680/2014, updating the technical rules regarding reporting of the leverage ratio.

Details of the individual elements included in the leverage ratio calculation at 31 December 2018 are provided below. The Leverage Ratio indicator was 4.57% in December 2018, with the transitional definition of Tier 1 capital, or at 3.75% with fully-adopted definition of the said capital.

For completeness, note that these ratios were calculated on the basis of total exposures, which had not yet benefited from the effects of the derisking and capital management projects, which will be fully applied during the first half of 2019.

Vice versa, own funds are already weighed down by the correlated extraordinary cost components, already spent in the year just ended.

The quantitative disclosure at 31 December 2018 is presented below in accordance with the templates provided for in Implementing Regulation (EU) 2016/200 of 15 February 2016.

LRSum table: Reconciliation of accounting assets and exposure for calculating the Leverage Ratio

Reference Date 31/12/2018 31/12/2017 Entity name Banco BPM Level of application consolidated LRSum Template: Summary reconciliation of accounting assets and leverage ratio exposures Applicable amount 1 Total assets as per published financial statements 160,464,791 161,206,765 Adjustment for entities which are consolidated for accounting purposes but are 2 -125,320 -143,041 outside the scope of regulatory consolidation (Adjustment for fiduciary assets recognised on the balance sheet pursuant to the applicable accounting framework but excluded from the leverage ratio total 3 0 0 exposure measure in accordance with Article 429(13) of Regulation (EU) No 575/2013) 4 Adjustment for derivative financial instruments 627,455 5 Adjustment for securities financing transactions (SFT) 1,419,503 0 Adjustment for off-balance sheet items (i.e. conversion to credit equivalent amounts 6 0 0 of off-balance sheet exposures)

(Adjustment for exempted intragroup exposures excluded from the leverage ratio EU-6a total exposure measure in accordance with Article 429(7) of Regulation (EU) No 0 0 575/2013)

(Adjustment for exposures excluded from the leverage ratio total exposure measure UE-6B 0 0 in accordance with Article 429(14) of Regulation (EU) No 575/2013)

7 Other adjustments 10,133,205 10,822,825 8 Leverage ratio total exposure measure 172,519,634 171,886,549 LRCom table: Leverage ratio disclosure

Reference Date 31/12/2018 31/12/2017 LRCom Template: Harmonised disclosure on leverage ratio CRR leverage ratio exposure On-balance sheet exposures (excluding derivatives and SFTs) On-balance sheet items (excluding derivatives, SFTs and fiduciary assets, but 1 150,462,117 152,473,414 including collateral) 2 (Asset amounts deducted in determining Tier 1 capital) -2,444,951 -2,574,638 Total on-balance sheet exposures (excluding derivatives, SFTs and fiduciary 3 148,017,166 149,898,776 assets) (sum of lines 1 and 2) Derivative exposures Replacement cost associated with all derivative transactions (i.e. net of eligible 4 470,256 595,726 cash variation margin) Add-on amount for potential future exposures associated with all derivative 5 627,455 735,998 transactions (mark-to-market method) EU-5a Exposure determined with Original Exposure Method 0 0 Gross-up for derivative collaterals provided where deducted from the balance 6 0 0 sheet assets pursuant to the applicable accounting framework (Deductions of receivables for cash variation margin provided in derivative 7 -878,365 -291,115 transactions) 8 (Exempted CCP leg of client-cleared SFT exposure) 0 0 9 Adjusted effective notional amount of credit derivatives sold 0 0 (Adjusted effective notional offsets and add-on deductions for credit derivatives 10 0 0 sold) 11 Total derivative exposures (sum of lines 4 to 10) 219,346 1,040,609 SFT exposures Gross SFT assets (with no recognition of netting), after adjusting for sales 12 7,000,904 6,459,939 accounting transactions 13 (Netted amounts of cash payables and cash receivables of gross SFT assets) 14 Counterparty credit risk exposure for SFT assets 1,419,503 1,439,309 Derogation for SFTs: counterparty credit risk exposure in accordance with Articles EU-14a 0 0 429-ter(4) and 222 of Regulation (EU) No 575/2013 15 Agent transaction exposures 0 0 EU-15a (Exempted CCP leg of client-cleared SFT exposure) 0 0 16 Total SFT exposures (sum of lines 12 to 15a) 8,420,407 7,899,248 Other off-balance sheet exposures 17 Off-balance sheet exposures at gross notional amount 15,862,714 13,047,916 18 (Adjustments for conversion to credit equivalent amounts) 19 Other off-balance sheet exposures (sum of lines 17 and 18) 15,862,714 13,047,916 (Exempted exposures in accordance with Article 429(7) and (14) of Regulation (EU) No 575/2013 (on and off balance sheet)) (Intra-group exposures (individual basis) exempted in accordance with Article EU-19a 0 0 429(7) of Regulation (EU) No 575/2013 (on and off balance sheet)) Exempted exposures in accordance with Article 429(14) of Regulation (EU) No EU-19b 0 0 575/2013 (on and off balance sheet) Capital and total exposure measure 20 Tier 1 Capital 7,888,137 9,608,342 Leverage ratio total exposure measure (sum of lines 3, 11, 16, 19, EU-19a and EU- 21 172,519,634 171,886,549 19b) Leverage ratio 22 Leverage ratio 4.57% 5.59% Choice on transitional arrangements and amount of derecognised fiduciary items "transitional "transitional UE-23 Choice on transitional arrangements for the definition of the capital measure arrangements" arrangements" Amount of derecognised fiduciary items in accordance with Article 429(11) of UE-24 Regulation (EU) No 575/2013 LRSpl table: Division of the exposure

Reference Date 31/12/2018 31/12/2017 LRSpl Table: Split-up of on balance sheet exposures (excluding derivatives, SFTs and exempted exposures)

CRR leverage ratio exposure Total on-balance sheet exposures (excluding derivatives, SFTs, and exempted UE-1 149,583,753 152,182,298 exposures), of which: UE-2 - trading book exposures 3,296,241 5,021,445

UE-3 - banking book exposures, of which: 146,287,512 147,160,853

UE-4 - covered bonds 101,819 110,264

UE-5 - exposures treated as sovereign issuers 34,405,491 32,685,821 - exposures to regional governments, MDBs, international organisations and UE-6 653,381 745,755 PSEs not treated as sovereign issuers UE-7 - entities 8,927,323 10,036,049

UE-8 - secured by mortgages on real estate properties 36,503,088 34,486,423

UE-9 - retail exposures 14,537,010 12,929,228

UE-10 - businesses 33,564,068 35,779,234

UE-11 - exposures in default status 7,961,925 13,051,420 - other exposures (e.g. equity instruments, securitisations, and other non-loan UE-12 9,633,407 7,336,659 assets)

Fourth quarter 2018 - Comment on the exposures considered in the leverage calculation

At 31 December 2018, the Group's operations confirmed the minimal decrease in exposures computed for the leverage ratio, compared to the situation presented at the end of the previous year, showing a trend in line with the reduction of capital assets on the balance sheet.

SFT contracts show exposures up by 8.4% (credit risk) and down by 1.4% (counterparty risk), the latter especially influenced by securities lending transactions.

They mainly consist of contracts entered into with Qualified Central Counterparties and/or leading Italian/foreign banking counterparties.

Financial derivative contracts show exposures down by 37.9% for the replacement cost and down 14.7% for future loan exposure.

They mainly consist of contracts offset in the context of netting agreements, that is Interest Rate Swaps entered into with Qualified Central Counterparties and/or leading Italian/foreign banking counterparties.

At the end of the year there were no deductions for cash variation margins received in relation to derivative transactions.

Deductions for receivables resulting from change margins in cash provided in transactions on derivatives instead increased by 201.7%, almost entirely represented by daily change margins. Off-balance-sheet items with 20% FCC fell by 58.5% and are mainly represented by margins available on credit lines for loans with M/L-term repayment schedules (see Medium/low risk items pursuant to Annex 1 Reg. CRR).

The aggregate is however residual in the context of off-balance-sheet exposures.

Off-balance-sheet items with FCC of 100% increased by 203.3% and are mainly represented by commitments for put option contracts sold to leading Italian/foreign banking counterparties; and, as second component, by financial sureties, whether issued directly or requested from foreign correspondent banks in the interest of third parties.

The other off-balance sheet items showed negligible changes.

Similarly to what was presented in the previous disclosure to the public, in the fourth quarter of 2018 no credit derivative contracts on loans were recognised among the gross exposures used in calculating financial leverage.

Other assets show a decrease of 1.3%.

As regards the differences in Tier 1 Capital, as well as for the related deducted assets, please refer to the explanations in the previous section “Own Funds”. Remuneration and incentive systems and practices

SECTION I

Banco BPM Banking Group staff remuneration policies - 2019 Policy

Policy 2019

1. Reference Legislative Framework On 23rd October 2018 the Bank of Italy issued new provisions on remuneration policies and practices in Banks and banking groups (update 25 of Circular no. 285/2013, hereinafter Bank of Italy Supervisory Provisions), with the purpose of implementing the essential contents of the "Guidelines on sound remuneration policies" in turn issued by the European Banking Authority (EBA) in December 201511 pursuant to directive 2013/36/EU (CRD IV)12 in consideration of the evolution of market practice and experience acquired by supervisory authorities in this field.

The 2019 Policy complies with the Regulatory Provisions of the Bank of Italy and transposes the Delegated Regulation (EU) 604/2014 of 4th March 2014, published on 26th June 2014, concerning technical regulation standards for the identification of identified staff.

2. Purpose of the 2019 Policy Remuneration policies provide important managerial leverage, for the purposes of the correct positioning of management and staff to the limitation of risks taken by the intermediary and for customers protection, in a spirit of correct conduct and management of conflicts of interest; remuneration policies not set up with care can, in fact, exacerbate conflict of interest between intermediary and customer, incenting employees to behave opportunistically, to the investor’s detriment.

In the interests of all stakeholders the 2019 Policy defines guidelines for Group Staff remuneration and incentive systems, for the pursuit of long-term strategies, objectives and results, in accordance with the general framework of governance and risk management policies, levels of liquidity and capital strength, as well as to attract and retain individuals within the Group with professionalism and abilities suited for the Group’s needs, in the interests of competitiveness and good governance, in the pursuit of fairness within the business and on the external labour market.

Another purpose of the Group’s remuneration policies is to ensure suitable remuneration in view of long-lasting performance. This enables staff enhancement, the recognition of individual contributions in the achievement of results and discourages conduct detrimental to fairness criteria in relationships with customers and compliance with regulations, which generate excessive risk exposure or lead to regulatory breaches.

11 The Italian version was issued in June 2016. 12 The CRD IV directive was already implemented in Italian legislation in update 7 of circular no. 285/2013 18th November 2014. 3. Process of adoption and monitoring of remuneration policies

3.1. Adoption process The approval of remuneration policies is reserved for the Shareholders’ Meeting for companies that adopt the traditional system of management and supervision, such as Banco BPM.

Information on the decision-making process for the definition of remuneration policies is provided here below. Bodies and parties involved in the preparation and approval thereof are specified along with bodies and parties responsible for their correct implementation.

3.1.1 Shareholder's Meeting For companies governed with the traditional management and supervision model, the law (articles 2364 and 2389 of the Italian Civil Code) gives the Shareholders’ Meeting the power to establish the remuneration of the members of the Board of Directors and of the Executive Committee, as well as remuneration of Statutory Auditors (art. 2402 of the Italian Civil Code). The Shareholders’ Meeting is also responsible for approving remuneration and incentive policies for members of the Board of Directors, statutory auditors and other staff.

Specifically, in compliance with Bank of Italy Supervisory Provisions and pursuant to art. 11.3 letter (g) of the Bylaws, for Directors, Auditors and staff the Meeting resolves to adopt: (i) remuneration and incentive policies, including the Board of Directors’ potential proposal to fix a limit to the relationship between the variable and fixed components of individual remuneration of identified staff, higher than 1:1 and within the limit established by the regulations in force from time to time; (ii) remuneration and/or incentive plans based on financial instruments; (iii) criteria for determining payment to be agreed in the case of early termination of employment or office, including fixed limits such as payment in terms of annuity of fixed remuneration and the maximum amount that derives from implementation thereof.

Pursuant to the Bank of Italy Supervisory Regulations, the Shareholders’ Meeting also receives a report, sent at least annually, on remuneration systems and procedures as well as the way in which remuneration policies are implemented.

The Shareholders’ Meeting must also give an opinion, in favour or against (with a non-binding decision) on the current report pursuant to, and limited to, that provided in art. 123-ter, paragraph 6 of the Consolidated Finance Act.

3.1.2 Parent Company Board of Directors Pursuant to art. 24.1 of the Bylaws, the Board of Directors is responsible for supervising business strategy and management.

With particular reference to issues relating to remuneration, the Board of Directors must establish, pursuant to art. 22.1 of the Bylaws and subject to the Shareholders’ Meeting’s responsibilities according to art. 11.3 of these Bylaws,- at the suggestion of the Remuneration Committee and taking account of the Board of Statutory Auditors’ opinion – the remuneration of members of the Board of Directors appointed to particular offices or responsibilities or delegated responsibilities, or those that are assigned to committees in accordance with the Bylaws.

Without prejudice to the Remuneration Committee’s advisory and proposal powers as outlined in paragraph 3.1.4 below, the Board of Directors: (i) shall draw up at least annually, submit to the Shareholders’ Meeting and re-examine the remuneration and incentive policies, and is responsible for their correct implementation (additionally ensuring that (a) the remuneration policy is suitably documented and accessible within the corporate structure and that all staff are aware of the consequences of any breaches of regulations or of the ethical code or code of conduct; (b) remuneration and incentive systems suitably guarantee compliance with legislation, statutory regulations and any ethical code or code of conduct, promoting the adoption of behaviour in compliance with the aforementioned; (ii) shall define the remuneration and incentive systems, at least for the executive directors, members of general management (and similar bodies), those responsible for main business lines, corporate functions or geographical areas, those who report directly to the Corporate bodies, the management and staff of higher level control functions (and, specifically, ensure that these systems are consistent with the Bank’s overall decisions in terms of risk-taking, strategy, long- term objectives, framework of corporate governance and internal control).

3.1.3 Parent Company Chief Executive Officer Pursuant to art. 30.1. of the Bylaws, the Board of Directors appoints a Chief Executive Officer from among its members and confers specific responsibilities and powers upon the appointed person.

Pursuant to art. 30.2. of the Bylaws, the Chief Executive Officer is responsible, among other things, for supervising and ensuring staff management by applying the Company’s and the Group’s human resource policies. In this regard, and with particular reference to the interests of this report, on the basis of powers given to the Chief Executive Officer by the Board of Directors, they are vested with the following powers and the capacity to delegate them: (i) draw up proposals in accordance with the development and management of staff policies as well as for the Parent Company and subsidiary companies incentive systems for submission for approval of the Parent Company’s Board of Directors; (ii) for all staff of the Parent Company and the subsidiary companies of all types and levels, including managers (with the exception of positions reserved for approval by the Parent Company’s Board of Directors) to proceed with recruitment, promotion of staff in the Parent Company and in Group companies and define the remuneration and incentive systems in force from time to time.

3.1.4 Parent Company Remuneration Committee Pursuant to art. 24.4.1. of the Bylaws, the Board of Directors shall arrange a Remuneration Committee internally, approving the Regulations which determine its responsibilities and operation in accordance with the Supervisory Regulations.

The Remuneration Committee shall be composed of four directors, all non-executive and the majority of whom (one is elected as Chairman) having the independence requirements provided by art. 20.1.6. of the Bylaws. At least one member of the Committee must have suitable knowledge and experience in the financial field or of remuneration policies.

The Remuneration Committee, established with formal resolution issued on 10th January 2017, consists of the following four directors on the date of this report (and until the approval of the 2019 financial statements): Fabio Ravanelli (Chairman), Emanuela Soffientini (Vice Chairman), Paola Galbiati and Cristina Zucchetti. The Remuneration Committee is responsible for the functions and tasks assigned to it by the Self-Regulation Code of the Italian Stock Exchange (Borsa Italiana) and by applicable supervisory regulations (see Section 2 of Bank of Italy Supervisory Provisions).

In accordance with the provisions of the Supervisory Regulations of the Bank of Italy currently in force, the Bylaws and specific Regulation, the Remuneration Committee, has the following duties for the Parent Company, subsidiary banks and the Group’s main non-bank companies:

- advisory status and the task of making proposals regarding payment of directors, statutory auditors, general managers, co-general managers and deputy general managers;

- advisory status and the task of making proposals regarding payment to the executive responsible for preparing corporate accounting documents according to Art. 154-bis of the Consolidated Finance Act, the heads of the internal control functions – and therefore the Head of the Internal Audit Function, the Chief Risk Officer (CRO), where applicable, the Head of compliance function, the Head of the risk control function, the Head of the Anti-Money Laundering function and the Head of Internal Validation function – and the Head of the Human Resources Function;

- advisory status and the task of making proposals regarding payment of other staff whose remuneration and incentive systems are decided by the Board of Directors, as well as regarding determination of criteria for remuneration of other identified staff identified using the methods provided by the Bank of Italy Supervisory Regulations;

- advises, making use of information received from competent company functions, on the outcome of the identified staff identification process, including any exclusions pursuant to Section I par. 6.1 of Bank of Italy Supervisory Provisions;

- directly supervises the correct application of rules relating to remuneration of the heads of the internal control functions – as mentioned above – in close co-operation with the Board of Statutory Auditors;

- handles the preparation of documentation to submit to the Board of Directors for decisions relating to remuneration and incentive;

- collaborates with other committees within the Board of Directors and, specifically, with the Internal Audit and Risks Committee and the Appointments Committee;

- ensures the involvement of specialist corporate functions in the process of developing and inspecting remuneration and incentive policies and practices;

- advises, making use of information received from specialist corporate functions and, specifically, the Human Resources function, on achievement of performance objectives linked to incentive plans and on the inspection of other conditions established for payment;

- provides adequate reflection on activity carried out by the Board of Directors, the Board of Statutory Auditors and the Shareholders’ Meeting.

Referring, then, to their specific functions provided by the Self-Regulation Code of Borsa Italiana, the Committee performs, among other things, the following additional tasks:

- it periodically evaluates the suitability, overall consistency and practical implementation of remuneration policies regarding directors, statutory auditors and executives with strategic responsibilities, using information provided by the Chief Executive Officer and makes proposals in the area to the Board of Directors;

- presents proposals on remuneration of directors who perform particular offices, including setting performance targets relating to the variable component of this remuneration to the Board of Directors; it monitors in this respect the application of decisions adopted by the Board itself verifying, specifically, the actual attainment of performance targets;

- whenever it intends to use the services of a consultant to obtain information on market practices regarding remuneration policies, the Committee verifies in advance that it will not be faced into situations that compromise independence of judgement.

Each additional attribution to the Committee provided by the legislation and regulations, or supervisory bodies or approved by the Board of Directors is without prejudice.

The Committee shapes the conduct of its own duties in accordance with principles of autonomy and independence. Regarding remuneration, it performs its functions with the support of experts in the areas of risks, capital and liquidity management. To this end, it ensures that the incentives underlying the system and remuneration policies are consistent with the methodology adopted by the Bank for regulatory and internal risk management, making use of corporate risk control structures and, specifically, the Chief Risk Officer, where required, the Head of the risk control function and the Head of the compliance function who, together with the Head of the human resources function, attend meetings, unless otherwise determined.

In the performance of its duties, the Committee also has access to all areas of activity and corporate functions of the Group companies, both through central offices and peripheral structures, and has the right to obtain any information or data deemed necessary for the performance of its task. In any case, the Board of Directors ensures that the Committee is suitably equipped with resources to fulfil its task and exercise its powers, approving an annual budget within the limits of which the Committee may make use of specialist external consultants and acknowledged experts in the subject matter.

Further information relating to the Remuneration Committee, including information referring to its operation, is available in the “Report on Corporate Governance and Ownership Structures”, published on the website www.bancobpm.it.

With reference to activities carried out for 2019, the Committee met six times in the period spanning December 2018 and the first few months of 2019 and carried out activities of its own competence, depending on the case at hand, including the pursuit of investigations, the provision of advice and/or proposals, specifically regarding: (i) for essential elements constituting the identified staff identification policy and positive valuation of the implemented process and relative outcomes for 2019; (ii) upon acknowledgement of main new contents of Bank of Italy Supervisory Provisions; (iii) upon ascertainment that access conditions are met by staff for variable components of remuneration accruable in 2019 with reference to results achieved in 2018, in implementation of provisions contained in reference policies; (iv) upon ascertainment of performance levels achieved by the Parent Company Chief Executive Officer with reference to objectives assigned for 2018; (v) upon definition of proposal for remuneration policies for 2019 for Banco BPM banking group staff, as well as the remuneration plan based on shares of Banco BPM regarding the 2019 incentive system; (vi) upon proposal of criteria for determining any amounts to be agreed in case of early termination of employment of all staff, including limits set for said remuneration in terms of annuity of fixed remuneration and the maximum amount deriving from application thereof; (vii) upon objectives and associated incentive to be assigned to the Parent Company Chief Executive Officer for 2019; (viii) upon examination of the Remuneration Report of the Banco BPM Banking Group - 2019.

3.1.5 Parent Company’s Internal Audit and Risks Committees

Pursuant to art. 24.4.1. of the Bylaws, the Board of Directors shall internally establish Internal Audit and Risks Committees, approving the relative Regulation that determines their tasks and operation in compliance with the Supervisory Regulations.

The Internal Audit and Risks Committee shall be made up of four directors, all non-executives and the majority of whom (one elected as Chairman) having the independence requirements provided by the Bylaws. It is also expected that the members of the Committee must have the knowledge, abilities and experiences to be able to fully understand and monitor the Group’s risk strategies and guidelines; at least one member of the Committee must have suitable experience in accounting and financial matters, or of risk management.

The Internal Audit and Risks Committee, set up on the date of this report with the formal resolution of 10 January 2017 and a deadline for the approval of the 2019 financial statements, is made up of the following four directors: Mario Anolli (Chairman), Costanza Torricelli (Vice Chairman), Rita Laura D’Ecclesia and Carlo Frascarolo.

The Internal Audit and Risks Committee is responsible for the functions provided by the Bank of Italy supervisory regulations (see, specifically, the First Part, Title IV, Chapter 1, Section IV of Circular 285/2013), the Bylaws, as well as the Self-Regulation Code, performing specifically duties of support of the Parent Company’s Board of Directors on matters of risks and internal control systems, with responsibility for overseeing the entire Group.

With specific reference to the authority of the Committee regarding remuneration systems, it – notwithstanding the authority of the Remuneration Committee – verifies that the incentives submitted to the remuneration and incentive system are consistent with the RAF (Risk Appetite Framework) and formulates its own opinion on remuneration for the heads of the internal control functions, consistent with corporate policies.

Further information relating to the Internal Audit and Risks Committee, including information referring to its operation, is available in the “Report on Corporate Governance and Ownership Structures”, published on the website www.bancobpm.it.

In 2019, the Committee ascertained the consistency of the conditions proposed in the 2019 remuneration policies for access to the variable components of remuneration, with respect to the RAF approved by the Parent Company’s Board of Directors.

3.1.6 Parent Company’s Corporate functions involved in the process of definition of remuneration and incentive policies The process of defining remuneration and incentive policies provides for the involvement of appropriate corporate functions: the Parent Company’s Human Resources function ensures technical support to Bodies and arranges for support material prepared to draw up remuneration policies, in collaboration, each one according to its authorities, with the Risks, Compliance, Planning and Control, Administration and Accounts, Corporate Affairs Secretary and Participations functions.

In particular, the Risks function, in partnership with the Planning and Control function, identifies indicators and values to be compared relating to the strategic and performance objectives, which correlate the determination of variable components of remuneration and incentives in order to ensure coherence of the monitoring the suitability with respect to the Risk Appetite Framework approved by the Parent Company’s Board of Directors, to the long-term corporate strategies and objectives, linked to the risk-adjusted business performances, consistent with the levels of capital and liquidity necessary to meet the business undertaken.

3.1.7 Subsidiary companies Pursuant to the Bank of Italy Supervisory Regulations, the Parent Company shall establish the remuneration and incentive policies of the entire Group, it shall ensure its overall consistency, provide the guidelines necessary for their implementation and monitor their correct application; taking account therefore of policy-making and approval by the Parent Company as described in the previous paragraphs, the Board of Directors of each subsidiary recognises this Report, and the Shareholders’ Meeting of each subsidiary bank approves it insofar as their authorities.

3.2 Monitoring Process The process of monitoring the system of remuneration of Group Staff is regulated as follows: a) monitoring of regulatory compliance, to be carried out by the Parent Company’s Compliance function, that verifies the consistency of remuneration and incentive policies with that provided for in the existing legal and supervisory requirements, the Parent Company’s Bylaws, internal Group regulations as well as by potential ethical codes or other standards of conduct applicable to entities of the Group; b) internal audit, to be carried out by the Parent Company’s Audit function, which verifies compliance of the procedures implemented by the individual Group companies with the approved remuneration and incentive policies and the regulations in force from time to time.

The Risk function expresses itself on the correct activation of specific risk indicators of a financial and non-financial nature and which are used for correction methods (ex ante and ex post), within the scope of remuneration and incentive systems.

The Parent Company’s Audit and Compliance functions, to the extent of respective scope, bring to the attention of the Parent Company’s Board of Directors, the Board of Statutory Auditors, and of every subsidiary, the monitoring results indicated in items a) and b) above.

The Parent Company’s Board of Statutory Auditors shall assess the relevance of any shortcomings revealed by the monitoring process described for the purposes of prompt reporting to the Supervisory Authorities. 4.Identification of the Group’s identified staff The process for the identification of identified staff is defined based on Regulatory Technical Standards (RTS) issued by the European Banking Authority and provided for n Delegated Regulation (EU) no. 604/2014 (Regulation), which came into force on 26th June 2014, as well as the application of an additional criteria, specifically identified for the purpose of identifying any further persons who assume relevant risks for the Group and who may not have been identified on the basis of other criteria. The Parent company Human Resources function coordinates and formalises the process for the identification of identified staff for the Group on an annual basis, justifying outcomes and ensuring overall coherence, with the involvement of Parent company Organisation, Risks and Planning and Control functions.

The control process is implemented by Compliance and Audit functions, each within respective scope as described in paragraph 3.2 here above.

Upon hearing the Remuneration Committee, the Parent Company Board of Directors approves the identification process as part of the year's remuneration policy.

The identification process is implemented within all Group companies and requires assessment on an individual basis in the case of Italian Banks and at a Group level for all other subsidiary companies. Said process is carried out by the Parent company in virtue of outsourcing contracts in force, with the effective collaboration of the Group's banks. The key underlying principle of the Regulation process consists of the evaluation of the relevance of each person in terms of substantial risk-taking, on the basis of the individual position (for qualitative criteria, by way of example, but not limited to such, responsibility, hierarchical levels, levels of resolution are assessed) or remuneration (quantitative criteria).

The interpretation of qualitative criteria for the application of the identified staff identification process in the Group, has determined the following positions:

 members of the Board of Directors of the Group's Italian banks;

 Parent Company Risk, Compliance and Audit function managers as well as those who report directly to them (including managers of the Anti-laundering and Internal Validation structures);

 those who report directly to Management Bodies of the Group's Italian Banks (excluding managers of in staff functions), including Parent Company General Management;

 managers of relevant legal entity (namely those to whom at least 2% of Group regulatory capital has been distributed), managers of relevant operative units (namely those to whom at least 2% of regulatory capital of relevant respective legal entities has been distributed) and those who report directly to both categories (except for managers of in staff functions);

 managers in the first line of management of functions including legal affairs, finances, including taxation, budgeting and economic analysis, human resources, remuneration policies and information technologies, as well as appointed executives present in the Group;

 members with the right to vote (including on call members), as well as any participants with the right to vote, of Parent Company Management Boards for Asset Allocation, Finance, New products and markets, Risks and Crisis, and, for subsidiary Italian banks, committee members, if present, with identical resolution-making functions as those of Parent Company Committees;

 roles responsible for the submission of proposals or with the power to adopt, approve or veto credit risk exposures amounting to at least 0.5% of class 1 primary capital (CET1) of the Group or of single Italian banks, or the minimum threshold established by the Regulation, set at 5 million euro. Members of the Parent Company Executive Committee, members with the right to vote (including on call ones) are also identified, as are any participants with the right to vote, of the Parent Company Credit Committee and NPL Committee or of any Committees established in subsidiary companies with equivalent provision-making functions;

 roles assigned with proxies which can determine market risk exposure pertaining to trading portfolio amounting to at least 5% of Value at Risk (VaR) on a time to time basis, as provided at a single legal entity level;

 managers of groups of persons whose total power is equivalent to or higher than levels defined with reference to credit or market risk.

For quantitative criteria application purposes, all subjects belonging to the 0.3% of staff (including those with overall remuneration equal to or greater than 500,000 euro) who have been awarded overall remuneration greater than the previous financial year and all subjects who during the previous financial year received total remuneration equal to or greater than that of subjects identified for such qualitative criteria ( as specified in the Regulation), whose professional activity has a material impact on the risk profile of the legal entity at issue. With reference to persons identified based on quantitative criteria alone, the Group does not apply the procedure for the exclusion of identified staff as provided in Bank of Italy Supervisory Provisions an (EU) Decision 2015/2218 of the European Central Bank dated 20th November 2015.

Despite the distinction between staff belonging and not belonging to the internal control functions considered by the Bank of Italy Supervisory Provisions, the identified staff detected on the basis of the process implemented are classified as:

 top identified staff: the CEO, General Manager, Co-General Managers and Managers in the first line of management of the Parent Company, the CEO, General Manager, Co-General Manager and Deputy General Manager (where present) of Aletti & C. Banca d’Investimento Mobiliare, Banca Akros and ProFamily.

Top identified staff includes:

 senior identified staff: the CEO, General Manager, Co-General Managers, senior operational and executive managers of the Parent Company and Managers in the first line of management of the Parent Company not included amongst the internal control functions reporting directly to the CEO or the CEO of Aletti & C. Banca d’Investimento Mobiliare and of Banca Akros;

 other identified staff: the identified staff not included in the above category.

In 2019, process implementation resulted in the identification of 188 positions/subjects, amounting to approximately 0.8% of total Group staff. Compared to 2018, 11 new people and 4 new ad interim positions have been identified; 35 people are no longer identified, in virtue of their termination of employment, change of role, company reorganisation, quantitative criteria expiry. With reference to the Group's Italian Banks, the following positions/ subjects are identified13:

 Banco BPM: 147;

 Banca Akros: 23;

 Aletti & C. Banca d’Investimento Mobiliare: 12.

13 Those holding a position in more than one Group companies are listed once only. 5. Components of remuneration

5.1 Remuneration of the Group’s Corporate Bodies

5.1.1 Remuneration of the Parent Company’s Board of Directors members

The Shareholders’ Meeting approves the remuneration policies of the members of the Board of Directors and determines their reward package; the Shareholders’ Meeting is also responsible, pursuant to art. 2389 of the Italian Civil Code, for deciding the remuneration due to directors who are members of the Executive Committee.

Therefore, the entire Board of Directors is due – aside from reimbursement of costs incurred due to their employment – an annual payment that is determined, at a fixed rate, for the full period of the Shareholders’ Meeting established at the time of their appointment. The distribution of remuneration approved by the Shareholders’ Meeting, where not specified thereby, is established by the Board of Directors.

In connection with the approval of the merger between the former Banco Popolare Soc. Coop. and the former Banca Popolare di Milano Scarl, the corresponding Shareholders’ Meetings held on 15 October 2016 resolved the fixed compensation to be awarded to the Board of Directors and the additional component to be awarded for each member of the Executive Committee for the full period of their office, and therefore for the financial years 2017-2018-2019, to be allocated on a pro rata temporis basis in relation to the actual term in office.

For directors assigned particular offices, according to art. 22 of the Bylaws, the Board of Directors, on the basis of proposals formulated by the Remuneration Committee and having obtained the opinion of the Board of Statutory Auditors, determines the amount of emoluments to be paid, pursuant to art. 2389 paragraph 3 of the Italian Civil Code. In this regard, at the meeting held on 17 April 2018, the Board of Directors, on the proposal of the Remuneration Committee and having considered the opinion of the Board of Statutory Auditors, established the additional fixed components, proportional to the commitment required of the office and the relative responsibilities, for the period that will end on the date of the Shareholders’ Meeting called to approve the financial statements as at 31 December 2018.

At the meeting held on 14 March 2017, the Board of Directors - on the proposal of the Remuneration Committee and with the favourable vote of all members of the Board of Statutory Auditors - determined the fixed remuneration of the CEO, in accordance with article 2389 of the Italian Civil Code and article 22.1 of the Bylaws14.

A third-party insurance policy and a cumulative occupational accidents policy are planned for members of the Board of Directors. For the sake of completeness of information, it is also noted that a life insurance policy in favour of the current Chairman of the Board of Directors is in effect.

Neither variable components of the remuneration nor end-of-term payments are planned for members of the Board of Directors without individual contract.

The Chairman of the Board of Director’s remuneration does not exceed the fixed remuneration collected by the Chief Executive Officer or the General Manager.

14 See paragraph 6.5.1 with reference to variable remuneration correlated to the annual incentive system. 5.1.2 Remuneration of the Parent Company’s Board of Statutory Auditors

The Shareholders’ Meeting approves the remuneration policies of members of the Board of Statutory Auditors and determines the remuneration to be paid to them for the full term of their office.

Therefore, all members of the Board of Statutory Auditors are entitled – in addition to reimbursement of expenses incurred due to their office – to an annual amount which is determined by the Shareholders’ Meeting at the time of their appointment, at a fixed rate for the full term of their office.

In connection with the approval of the merger between the former Banco Popolare Soc. Coop. and the former Banca Popolare di Milano Scarl, the corresponding Shareholders’ Meetings held on 15 October 2016 resolved the compensation to be awarded to the Board of Statutory Auditors for their full term in office, namely for financial years 2017-2018-2019.

A third-party insurance policy and cumulative occupational accidents policy are planned for members of the Board of Statutory Auditors.

With regard to the Bank of Italy Supervisory Provisions, members of the Board of Statutory Auditors shall not receive any variable components of remuneration.

The Board of Statutory Auditors is not currently granted powers pursuant to art. 6.1 b, Italian Legislative Decree no. 231/2001; Banco BPM Banking Group’s Board of Directors, in their meeting on 10 January 2017, considering not to make use of the authorities laid out in paragraph 4-bis of the same article mentioned above, in fact it appointed a specific Supervisory Body (SB), assigned the task of monitoring, among other things, the observance and functioning of the organisational, management and monitoring model, and also of updating of the consequent powers and duties. The Parent Company’s SB provides for the appointment of a statutory auditor among its members; an additional payment is therefore given to this person for the office fulfilled in the SB.

5.1.3 Remuneration of members of Corporate Bodies of subsidiary companies

Provision is made for fixed remuneration differentiated in relation to their respective offices fulfilled within their respective organisations for members of Corporate Bodies of subsidiary companies, in addition to reimbursement for living expenses and possible attendance fees, where resolved by their respective Shareholders’ Meetings.

This remuneration is approved by the respective General Shareholders’ Meetings, according to the Bylaws, for members of the Board of Directors and the Board of Statutory Auditors of subsidiary companies.

No provision is made for variable remuneration components for members of the Boards of Directors lacking an individual contract.

With regard to the Bank of Italy Supervisory Regulations, members of subsidiary company Boards of Statutory Auditors do not receive any variable remuneration component; if they are also a member of the Supervisory Body established pursuant to Italian Legislative Decree 231/2001, it is envisaged that they will receive an additional emolument for the office held.

The emoluments of the Chairman of the Board of Directors of each subsidiary bank shall not exceed the fixed remuneration awarded to the head of the body with the function of managing the subsidiary company (Chief Executive Officer or General Manager). 5.2 Remuneration of the Group's employees

The system of remuneration of the Group’s employees provides the following.

1. A fixed remuneration component consisting of:

- gross annual remuneration (GAR), determined by relative labour contracts based on the National Labour Collective Agreement and any second-level contracts in force from time to time or in agreements with Corporate Parties. In this respect, interventions on the fixed component consist of promotions to more senior remuneration or placement based on an effective increase in responsibility, and personal allowances, awarded for continuing deserving performance;

- role allowances.

It is possible to assign role allowances, consisting of an increase in remuneration, paid on a monthly basis and subject to covering a specific position. This remuneration is predetermined, permanent, so long as the recipient does not change the office for which the remuneration was granted, does not provide incentives for risk-taking and is not revocable, but is discretionary, and reflects the level of professional experience and seniority. Therefore it is issued on the basis of predefined criteria:

- other benefits for personal and family use granted by the Parent Company and its subsidiary companies to their employees, resulting from national legislation and/or from second- level and/or deriving from specific internal reference policies.

The most important benefits concern the following areas: corporate welfare, supplementary pensions and healthcare. The Group’s employees, according to the specifics of the company to which they belong and/or the company of origin, also benefit from advantages when using bank services and insurance coverage.

2. A possible variable remuneration component, composed of:

- incentives linked to the incentive system on an annual basis (incentive), awarded in accordance with that provided in chapter 6 below;

- incentives linked to long-term incentive systems (LTI incentive), awarded in accordance with that provided in paragraph 6.8 below;

- for Group companies that apply the National Credit Contract a variable component connected to financial performance and/or to specific objectives (corporate bonus – National Labour Collective Agreement) is awarded according to specification contained in chapter 6 below, particularly with reference to conditions for payment15 and the application of malus and claw-back16 mechanisms. The criteria and methods for determination and payment of this remuneration17 are subject to information, comparison and/or negotiation with the Corporate Parties;

- for Group companies that apply the National Contract for Tourism and Public Businesses, a variable component connected to specific objectives (productivity bonus – National Labour Collective Agreement) is provided. The criteria and methods for determination and payment of this remuneration are subject to notification to the Corporate Parties;

15 See paragraph 6.3. 16 See paragraph 6.7. 17 By way of example, welfare services or Banco BPM shares, in the latter case prior specific resolution of competent corporate bodies and obtaining of necessary regulatory authorisations. - limited to other staff of the Group, therefore excluding identified staff identified for the reference year and for the previous year18, possible one-off payments may be granted, as a reward for professionalism and individual effort, in line with professional assessment (or equivalent) and in compliance with specified regulations. Said remuneration is subordinate to full compliance with the following conditions as identified in the last quarterly report available on a consolidated basis: (i) the Common Equity Tier1 (CET1) ratio “phased-in” capital adequacy indicator is higher than the relative Risk Trigger19 threshold as defined in the Risk Appetite Framework20; (ii) that the liquidity adequacy indicator Liquidity Coverage Ratio (LCR) regulatory is higher than the relative Risk Trigger threshold19 defined in the Risk Appetite Framework20; (iii) that the profit from current operating activities before tax (net of non-recurring items) is positive. The maximum limit of impact of these payments is fixed at 10% of the individual gross annual remuneration (GAR). The total amount of resources to be dedicated to these payments cannot exceed the limit of 0.2% of the recurring staff cost21, provided in the budget of the financial year in question;

- possible exceptional payments to newly-appointed staff in the Group, limited to the first year of employment (so-called welcome bonus); if not paid in a one-off solution upon hiring, said payments must take place in compliance with specifications set forth in paragraph 6.1 below;

- any payments connected to continuing staff, subject to their presence at a certain date (retention bonus); said payments must be made no earlier than the positive outcome of the correlated event, in compliance with capital and liquidity adequacy criteria as described in paragraph 6.9.2 here below as well as provisions set forth in paragraphs 6.1, 6.6 and 6.7 point 2 here below;

- any payments made for stability clauses, paid in compliance with the conditions of capital and liquidity adequacy as described in paragraph 6.9.2 here below as well as provisions set forth in paragraph 6.1 here below. For the purposes of the aforementioned it should be noted that for 2019 only payments correlated to clauses already in force will be made, in order to fulfil previously undertaken obligations with interested staff, therefore for 2019 it will not be possible to activate new clauses under such circumstances;

- any disbursements for non-competition clauses or notice period extension clauses paid according to employment contract or the termination thereof22, in compliance with specifications set forth in paragraph 6.9.2 here below (including specifications pertaining to capital and liquidity adequacy conditions), and, with reference to identified staff, with specifications provided in paragraph 6.1 here below.

- any additional employment termination amounts (golden parachute, in the case of identified staff); said payments must be made in compliance with specifications set forth in paragraph 6.9.2 here below (including specifications pertaining to capital and

18 As identified on process activation date. 19 Risk Trigger threshold means the lower point of the Risk Appetite objective area, in line with the RAF framework. 20 Expected value on 31/12 of the same financial year. 21 Staff cost identified in the budget of the relevant financial year, excluding the following variable remuneration components: bonus pool, pro rata cost of LTI incentives and one-off incentives. 22 Without prejudice to specifications provided for in Bank of Italy Supervisory Provisions. liquidity adequacy conditions), and, with reference to identified staff, with specifications provided in paragraph 6.1 here below23.

All remuneration procedures, even if not expressly indicated in items 1) and 2) above, provided that they are implemented following the Parent Company’s guidelines and in accordance with the regulations in force from time to time, are carried out subject to prior approval, both on merit and in financial terms, by the Parent Company’s Chief Executive Officer or by their delegates24.

A long-term incentive system is currently being developed for staff, ending in December 2022, upon the conclusion of the new strategic plan. Said system, financed partly by the saving of resources traditional allocated for other forms of variable remuneration and other forms of variable remuneration, aims to give a tangible signal in the sense of the promotion of a company culture oriented towards the alignment of staff interests with long term shareholder interests, with the awarding of an incentive to each employee, upon expiry, of an incentive correlated to the appreciation of Banco BPM shares during the plan, in the event the Group achieves positive performance levels. Said system, which may include the use of leveraged financial instruments underpinned by Banco BPM shares, will be consistent in any case with the reference framework for determining risk appetite, with risk government and management policies and with the purpose of pursuing healthy remuneration policies. At the end of the study currently under way, if the introduction of said system were to occur starting from 2019, a special Shareholder's Meeting will be called following the one convened for the 6th April.

Generally, unless stated otherwise in the individual’s work contract, the Group’s employees do not receive remuneration for positions held in Corporate Bodies of subsidiary and/or investee companies as designated by the Group. This remuneration is paid in full to the company to which they belong by the company in which the job is carried out. For those who do not receive remuneration for offices held in Corporate Bodies of subsidiary and/or investee companies, the incentive is not linked to these offices.

No remuneration is paid to employees of the Parent Company and of subsidiary companies which form part of the Supervisory Body (pursuant to Italian Legislative Decree 231/2001).

5.3 Remuneration of external non-employed staff The remuneration of external non-employed staff that the Group uses is regulated by the respective contracts.

For non-employed staff that fall into the category of financial advisers authorised for door-to-door sales and financial agents, the remuneration is comprised by a recurring component which may include, depending on the case, commission from entry fees and/or management fees and/or linked to the contribution of assured revenue and/or to units and/or to brokered volumes. A non- recurring component of remuneration may also be envisaged, which acts as an incentive; within the first year of employment, the payment of a welcome bonus may also be envisaged.

For non-employed staff who does not belong to the categories of financial agents, credit brokers, insurance agents and financial advisers authorised for door-to-door sales, the remuneration, regulated by the respective individual contracts, does not envisage bonuses.

The possible payment of non-recurring remuneration components is conditional to the conditions defined in chapter 6 below, including the application of malus and claw-back mechanisms; in

23 Unless defined in application of the predefined formula contained in paragraph 6.9.2 here below. 24 Power delegated by the Parent Company’s Board of Directors or by the Parent Company’s Chief Executive Officer to implement all formalities, acts and duties provided by the remuneration policies. addition to indicators of a quantitative nature, it is also correlated with qualitative indicators expressed with criteria that can be quantitatively measured (by way of example, but not limited to such, the risk involved in its different meanings, the compliance with the legislation and regulations, customer protection and increase of loyalty, product quality, quality of the service provided, containment of complaints and legal or reputational risks), in line with guidelines of the Group's incentive system25. The Parent Company’s audit function must verify these criteria, pursuant to specifications contained in item a) of paragraph 3.2 above.

6. Characteristics of the remuneration and incentive system The characteristics of the remuneration and incentive system for Group staff are illustrated in this chapter, taking into consideration strict criteria in evaluating results achieved. In compliance with legislation in force, the award of variable remuneration components takes account of profitability, necessary levels of capital resources and liquidity (hereafter entry gates), and is determined by performance indicators measured excluding risks (hereafter the financial and non-financial adjustment factor), taking into account the quality of performance carried out.

The Group’s Staff cannot use personal hedging strategies or insurances on remuneration to undermine the risk alignment effects embedded in their remuneration arrangements. To ensure compliance with the aforementioned, within the scope of the remuneration policy control process26 the Audit function carries out sample evaluations of internal custody and administration accounts, at least of identified staff who are holders or co-holders; detected breaches are identified as misconduct27. Based on Bank of Italy Supervisory Provisions, by means of the process activated by the Parent Company's Human Resources function, the bank requests identified staff to notify the existence or opening of custody and administration accounts at other intermediaries.

No Staff Group initiatives which may affect risk alignment mechanisms is envisaged, including in the incentive system28.

6.1 Relationship between variable and fixed components of remuneration Fixed remuneration29 is understood as the collection of elements referred to in point 1) of paragraph 5.2, as well as the recurring component of remuneration referred to in paragraph 5.3. Variable remuneration is understood as the collection of elements referred to in point 2) of paragraph 5.2, as well as the non-recurring component of remuneration referred to in paragraph 5.3.

The upper limit of the variable/ fixed component ratio of Group Staff is:

 2:1 for specific figures deemed to be strategic and selected from top identified staff and Finance, Corporate, Investment Banking and Private Banking staff, as resolved by the Ordinary Shareholder's Meeting held on 7th April 2018 (see infra);

 1/3 for all staff belonging to internal control functions30, in compliance with Bank of Italy Supervisory Provisions;

 1:1 for all staff not included in aforementioned categories.

25 See paragraph 6.5 26 See paragraph 3.2 27 See paragraph 6.7. 28 Without prejudice to the introduction of a long-term incentive system, currently being studied(see paragraph 5.2). 29 Without prejudice to specifications provided for in Bank of Italy Supervisory Provisions. 30 The scope of application of said limit was adjusted based on Bank of Italy Supervisory Provisions (see Definitions, internal control functions). With reference to profiles required by legislation and Bylaws, the Ordinary Shareholder's Meeting held on 7th April 2018 approved a raise in the upper limit for general criteria (1:1) of up to 2:1 (as permitted by the Bank of Italy) for specific figures as listed in the previous paragraph. The proposal submitted to said Shareholder's Meeting was grounded in the need to use all management drivers to attract and maintain professional persons with skills suited to company requirements, for enhanced competitiveness and good governance. To this effect and also taking into account that major competitors of the Group had already approved a ratio upper limit increase to 2:1 for variable to fixed remuneration, adjustment to market practice enables the Group to bolster its remuneration driver on total compensation. Given that conditions for increase remain unchanged, reference staff and the upper ratio limit between variable and fixed component of remuneration as resolved by the Ordinary Shareholder's Meeting held on 7th April 2018, in compliance with Bank of Italy Supervisory Resolutions, it is not required that said topic is once more submitted to the Meeting for resolution.

6.2 Determination of the bonus pool The Group’s bonus pool 31 constitutes part of the consolidated staff costs, approved by the Parent Company’s Board of Directors at the end of the Group’s budgeting process.

The annual amount of the above-mentioned Group bonus pool, with regard to the cited process, only in the event that the budget envisages a profit32 may not exceed the threshold of 20% of the profit from current operating activities before tax (net of non-recurring items)33 consolidated under the financial year’s budget; it is fixed also taking into account the Group’s capitalisation and liquidity objectives.

6.3 Connection between bonus pool and results The award of the bonus pool is subject to the full compliance with predefined entry gates, as well as that indicated in paragraph 6.4 below and is implemented in accordance with the guidance issued from time to time by the Supervisory Authority.

In accordance with the Risk Appetite Framework approved by the Parent Company’s Board of Directors, the award of the incentive and corporate bonus is therefore subject, for both identified staff and other staff, to indicators and relative values for comparison:

- consolidated capital adequacy indicator: Common Equity Tier1 (CET1) ratio “phased- in”, greater than Risk Trigger34 threshold defined in the Risk Appetite Framework35;

- consolidated liquidity adequacy indicator: Regulatory Liquidity Coverage Ratio (LCR), higher than the Risk Trigger34 threshold defined in the scope of the Risk Appetite Framework35;

31 Excluding financial agents, insurance agents and financial advisers authorised for door-to-door sales, for whom a dedicated bonus pool may be envisaged, approved by the Chief Executive Officer of the Parent Company. 32 Profit from current operating activities before tax (net of non-recurring items). 33 Profit from current operating activities before tax (net of non-recurring items), calculated without taking account of the amount of that bonus pool. 34 Risk Trigger threshold means the lower point of the Risk Appetite objective area, in line with the RAF framework. 35 Value envisaged on 31/12 of the financial year. - consolidated profitability indicator: profit from current operating activities before tax (net of non-recurring items), greater than zero.

Furthermore, in addition to conditions listed in the previous paragraph, for subsidiary Italian Banks,36 the awarding of the incentive is subject to the indicator and relative comparative value, both for identified staff and all remaining staff:

- company profitability indicator: profit from current operating activities before tax (net of non-recurring items), greater than zero.

The table summarises the conditions for entry to the bonus pool expected for staff.

Indicator Comparison value Rule for accessing Valid for

> Risk Trigger threshold CET1 ratio “phased-in” - incentive system defined in the scope of the Group Companies -consolidated level- RAF - company bonus > Risk Trigger threshold LCR regulatory - incentive system defined in the scope of the Group Companies -consolidated level- RAF - company bonus Profit from current operating activities before tax (net of non- - incentive system > 0 Group Companies recurring items) - company bonus before tax -consolidated level- Profit from current operating activities before tax (net of non- Subsidiary Italian > 0 - incentive system recurring items) Banks before tax -company level-

6.4 Adjustment factor for the bonus pool Following verification of the condition provided in paragraph 6.3 above, but before potential payment, the effective amount of the bonus pool available is determined based on profit achieved (financial adjustment factor) as well as qualitative indicators of a non-financial nature (non-financial adjustment factor). In both cases, conditions are included and monitored, in line with the Group Risk Appetite Framework.

6.4.1 Financial adjustment factor

Specifically, for economic resources of the incentive system, an adjustment factor, the size of which is proportional to the consolidated value of the Return on Risk Adjusted Capital (RORAC) profitability indicator obtained at the end of the financial year in comparison with the relevant Risk Trigger and Risk Appetite thresholds defined in the scope of the Risk Appetite Framework for the financial year in question, is applied to the bonus pool as illustrated below37.

36 Banca Akros and Aletti & C. Banca d’Investimento Mobiliare (see Definitions). 37 Both the final balance value and the comparison thresholds are determined as a relationship between the financial year’s results, represented by the net result of 31/12 calculated excluding non-recurring items and without considering the amount of the bonus pool, and the end of year capital requirement as a percentage of activities considered for risk (RWA - Risk Weighted Assets), in line with Minimum Capital Requirement OCR (TSCR + CCB) provided for the year, as per SREP decision. The application of the financial factor to economic resources of the incentive system defined in the budget for the year (without prejudice to the portion awarded to identified staff of functions with control duties, therefore those for which the following does no apply, in order to avoid the incentive from being linked to economic profit) may result in their reduction (up to zero) or increase, in the latter case subject to approval by the Parent Company Board of Directors, which also determines the exact figure, specifically:

 in the case of a result equal to or lower than the Risk Trigger threshold, economic resources are set to zero;

 in the presence of a result higher than the Risk Trigger threshold but lower than the midpoint between the Risk Trigger and Risk Appetite thresholds (hereafter midpoint), the Parent Company’s Board of Directors has the authority to decide the potential availability of economic resources up to a maximum of 50% of budget value; the potential payments will not be able to relate to identified staff;

 in the case of a result at least equal to the midpoint but no higher than the Risk Appetite threshold, the value of financial resources envisaged in the budget is automatically reduced by applying the percentage given by the relationship between the midpoint result and the Risk Appetite threshold;

 in the presence of a result higher than the Risk Appetite threshold, any increase of the financial resources up to the expected cap of 110% of their value in the budget is subject to a decision by the Parent Company’s Board of Directors, which also determines the exact measurement in relation to and within the limit of the relationship between the result achieved and the Risk Appetite threshold.

The factors to apply to the financial resources of the incentive system are shown in the table below.

Financial adjustment factor to multiply by the RORAC achieved (R) financial resources of the incentive system38

0%

The Parent Company’s Board of Directors has the authority to decide the payment until a maximum amount equal to 50% of the financial resources envisaged in the budget.

Mid point39 ≤R ≤ Rorac Risk Appetite % data by the ratio: RORAC achieved / RORAC Risk Appetite.

Percentage determined by the Parent Company’s Board of Directors in relation to and within the ratio RORAC achieved / RORAC Risk Appetite, with a fixed cap of 110%.

38 The factor does not affect the portion of the financial resources of the incentive system assigned to identified staff tasked with auditing. 39 Midpoint between the Risk Trigger and Risk Appetite thresholds. In the event of a change in the financial resources of the incentive system following the application of the financial adjustment factor, the same change is also applied to the relative portions assigned to identified staff that do not belong to the functions with control tasks, determined by the amount of potentially accruable incentives; the portion of the financial resources of the incentive system of identified staff belonging to the functions with control tasks will remain unchanged in virtue of the effect of the financial adjustment factor.

6.4.2 Non-financial adjustment factor

The financial resources of the incentive system are also subjected to the application of a non- financial adjustment factor according to methods described here below; said figure is calculated in relation to the values of the consolidated Reputational Risk and Anti Money Laundering (AML) indicators at the end of year, in relation to the relative Alert limits defined in the context of the Risk Appetite Framework for that year.

The Reputational Risk indicator represents the total economic capital against the reputational risk estimated through an internal model. The state of the Group's reputation is monitored through collection and analysis of indicators, both of a quantitative and qualitative nature, that may influence, on the basis of their characteristics, the Group’s reputation in regard to the main stakeholders (customers, shareholders, market counter parties, regulators, employees, and the financial community) employing reporting and forecasting, and considering stress conditions. The indicators selected are both internal, i.e. derived from company processes, and external to the Group, i.e. derived from market data, and belong to the following risk areas: market, litigation/sanctioning, IT services, corporate social responsibility, regulatory affairs.

The AML indicator represents the ratio between the total number of customers at high risk (maximum classification in the context of the internal Anti-recycling model for the management of money-laundering risk) and the total number of customers.

Application of the non-financial factor may result in the contraction of economic resources of the incentive system for all staff, including identified staff with control tasks; therefore it bears on:

 the economic resources of identified staff which do not belong to functions with control tasks, determined following the application of the financial adjustment factor to total potentially accruable incentives;

 the economic resources of identified staff with control tasks, determined by total accruable incentives;

 the economic resources of remaining staff, determined following the application of the financial adjustment factor.

More specifically:

 in the case of a result equal to or greater40 than the Alert limit of both the Reputational Risk and AML indicators, the value of the financial resources is automatically reduced by 20%;

40 The greater the value recorded, the greater the risk for the Group.  in the case of a result equal to or greater than the Alert limit of only one of the indicators, Reputational Risk or AML, the value of the financial resources is automatically reduced by 10%;

 in the remaining cases, the financial resources are not reduced.

The factors to apply to the financial resources of the incentive system based on the result (R) are shown in the table below.

Reputational Risk

no reduction -10% AML -10% -20%

6.4.3 Equalisation mechanism

If the financial resources of the incentive system following application of the financial and non- financial adjustment factors are insufficient to cover the total amount of bonuses calculated on the basis of performance achieved, an equalisation mechanism will be applied. This consists of the proportional reduction of individual incentives. With specific reference to identified staff, said reduction will be applied using the same percentage as the individual bonuses in relation to category (whether or not belonging to the function with control tasks).

6.4.4 Limits to distributions - combined capital buffer requirement

According to the Bank of Italy Supervisory Provisions41, in cases where the combined capital buffer requirement42, no distribution is made in relation to Common Equity Tier 143 44 that may result in lowering the same to a level for which that the same requirement is no longer respected.

In case of non-compliance with the combined capital buffer requirement, the variable components of remuneration may be awarded and/or paid within the limits and under the conditions indicated in the same Bank of Italy Provisions.

In any event, all decisions regarding dividends and variable remuneration must take into account the recommendations made by the European Central Bank45.

41 See Circular 285 of 17 December 2013 (and subsequent updates) “Supervisory Provisions for Banks” (First Part, Title II, Chapter 1, Section V, paragraph 1 “Restrictions on distributions”). 42 For this definition, please see article 128, point 6 of the Directive 2013/36/EU. 43 For this definition, please see art. 25 of the Regulation (EU) no. 575/2013. 44 The restrictions on distribution provided in this paragraph apply to payments that comprise a reduction in Common Equity Tier 1 or a reduction of earnings, if the non-payment or suspension of payments does not constitute event of default or a condition for starting an insolvency procedure pursuant to the regulation of banking crises. 45 See the general recommendation of the European Central Bank of 07 January 2019 on dividend distribution policies and the recommendations specifically sent to Banco BPM on “Dividend distribution Policy” and “Variable remuneration Policy”, 9th January 2019. 6.5 Incentive System The incentive system consists of entry gates as described in paragraph 6.3 here above, of financial and non-financial adjustment factors as described in paragraph 6.4 here above and of implementations and methods described here below, applied by means of the allocation of objectives correlated to an annual assessment period. Said elements ensure connection with risks, compatibility with levels of Group capital and liquidity, orientation towards the achievement of results in the medium-long term and compliance with regulations.

In addition to the evaluation of achieved performance levels in terms of quantitative results, the incentive system is also characterised by mechanisms oriented towards the control of different forms of risks and staff achievement of conduct which complies with the reference legislative and regulatory framework, time to time in force and issued with the purpose of utmost customer satisfaction. Said purpose is pursued via joint action mainly of three different elements:

 the use of parameters of a qualitative nature and which impact incentive quantification and which are expressed with quantitatively measurable criteria used to gauge customer satisfaction, operative excellence in the service provided, compliance with regulations (by way of example, but not limited to the results of customer satisfaction surveys, the number of complaints, adequateness of customer assistance, compliance with legislation and regulations, assessment of performance and/or management qualities);

 with reference to risk containment, the allocation:

 for commercial networks, wherever applicable of the objective pertaining to the control of credit risk profiles;

 for identified staff, of risk based or risk adjusted KPI, in line with risks assumed by staff with reference to responsibilities and activities pursued in respective organisation unit, in the reference Risk Appetite Framework, with particular attention to operative risk;

 provision of malus claw-back mechanisms46, which directly affect the incentive and even setting it to zero, with the purpose of discouraging misconduct.

Such provisions, adopted and implemented right from the first year of the Group in business, are for the promotion of a company culture oriented towards fairness in the pursuit of own responsibilities and activities as well as simultaneous risk management, thus favouring a context of lower potential impact on operative risks and conduct. They establish focus on operative excellence and on the service provided, indispensable for satisfying increasingly demanding customer expectations, in compliance with legislation and regulations.

For risk takers identified on the basis of their responsibilities receiving incentives and for specific staff of the sales network47 the MBO (Management by Objectives) method of appraisal is adopted, which envisages the assignment, when starting the system, of objectives to compare with results achieved at the end of the year; in the remaining cases, the system is based on managerial appraisal of the head of the department to which they belong.

46 See paragraph 6.7. 47 The list of people to receive MBO is not exhaustive. The MBO considers a contained number of indicators, in order to focus on the Bank's priority objectives and to which a percentage weight is attributed to the total and a results curve on levels of achievement (minimum, target and maximum); the result obtained by each KPI determines a weighted score to be achieved, on a knowledge curve varying between a minimum and maximum; the amount of weighted scores obtained corresponds to the performance achieved which, only if it is at least equal to fixed minimum score, allows for quantification of the incentive amount; this amount in any case cannot be above a fixed upper limit.

For recipients of MBO, the value of the incentive is calculated, in consideration of the financial resources, with reference to the level of the position, the proximity of the function concerned to the company’s business operations and the individual’s total remuneration with reference to benchmarks. A percentage will be associated with every cluster, which will increase as the combination of the position and proximity to the company’s business operations increases; this percentage, applied to the reference market gross annual remuneration (GAR) for the position/office, will determine the maximum amount within which the potentially accruable incentive can be defined, considering also the individual’s total remuneration.

6.5.1 Incentive system for the Parent Company’s Chief Executive Officer Objectives defined for the Chief Executive Officer for 2019 regard profitability, liquidity, capital requirements, value generated by the business for shareholders and qualitative aspects regarding management activities, with particular reference to operative risk. Said objectives also present a combination of quantitative and qualitative criteria, in the form of absolute criteria, namely those which refer to Group profit, and relative criteria, which enable comparison with similar bodies, as suggested by the EBA in its "Orientation regarding healthy remuneration policies"48. Risk based indicators account for 40% of total MBO, indicators expressed in relative criteria account for 45%. Achievement levels required for profitability and liquidity are respectively correlated with budget value and thresholds established in the Risk Appetite Framework approved by the Parent company Board of Directors for the year. The amount of the incentive associated with 2019 objectives for the Chief Executive Officer can amount to a maximum of 100% of his gross annual remuneration (GAR).

As regards the awarding conditions for the variable remuneration, the same provisions, with reference to this chapter 6, for the identified staff not belonging to the internal control functions are applicable.

Area Criteria Objective

Consolidated profit from current operating activities before tax Profitability absolute (net of non-recurring items)

Profitability absolute Consolidated Cost to Income ratio49

Liquidity absolute ConsolidatedLiquidityCoverageRatio(LCR) 49

48 See point 194: "The measurement of absolute results must be established by the body based on its own strategy, including its risk profile and risk appetite. The measurement of relative results is required to compare results with similar internal persons (within the organisation) or external persons (similar bodies)." 49 Risk-based objective. Positioning of Banco BPM regarding the annual improvement of the Pillar 2 Requirement as established in the SREP Decision 2019 Capital requirement relative (P2R) in relative terms compared to the requirement of the previous year42 Value created by Positioning of Banco BPM regarding Total Shareholder Return the company for relative (TSR - source Bloomberg) shareholders Qualitative aspects Qualitative assessment of Chief Executive Officer management regarding individual activities, with particular reference to operative risk managerial activity

6.6 Payment of incentive

The methods for payment of incentives to the Group’s staff are described in the following paragraphs.

6.6.1 Payment of incentive of other staff The incentive for other staff is paid in cash and on a one-time basis, by the month of July of the year following the relevant year.

The incentive determined on the basis of performance achieved will not apply in cases of termination of employment (unless with prior consent from the Parent Company, for specific provisions contained in individual or collective contracts, in corporate agreements, that is, for a unilateral corporate initiative, with a case-by-case evaluation necessary according to the time when the termination took place).

6.6.2 Payment of incentive of identified staff

The incentive of risk takers50 identified in the year is divided into an up-front portion and deferred portions.

The up-front portion, to be awarded within the month of July of the year after accrual, irrespective of the beneficiary, is as follows:

- 60% of awarded incentive, if lower than 430,000 euro;

- 40% of awarded incentive, if equal to or greater than 430,000 euro.

For the Group, the value 430,000 euro is a particularly high variable remuneration level, determined according to criteria set forth in Bank of Italy Supervisory Provisions51.

50% of the up-front incentive portion is awarded in the form of Banco BPM ordinary shares.

Other deferred portions consist of:

- five annual portions of equal amount deferred over the five year period following the year in which the up-front portion is vested, to be paid within the month of July each year, consisting of 55% Banco BPM ordinary shares for the senior identified staff, irrespective of the amount of the awarded incentive, and for identified staff reporting

50 With the exception of employees of the Group who hold office in the Board of Directors of subsidiary companies in representation of the Group itself, the employee does not receive any fixed or variable remuneration for this office. 51 See, First Part, Title IV, Chapter 2, Section III, Paragraph 2: "The amount of particularly high variable remuneration means the lowest out of: i) 25 percent of total mean remuneration of Italian high earners, as stated in the latest report published by the EBA; ii) 10 times the total mean remuneration of Bank employees.". directly to the Chief Executive Officer of Italian subsidiary banks, in the event the awarded incentive is equal to or greater than 430,000 euro; - three annual portions of equal amount, deferred over the three years after the year in which the up-front portion is vested and to be awarded within the month of July each year, consisting of 50% Banco BPM ordinary shares for identified staff not belonging to aforementioned categories.

There is a retention period (selling restriction) on the shares vested of one year both for the up- front shares and for deferred shares; for the latter, the retention period starts from the moment in which the deferred remuneration is vested. The vesting of the share portions takes place at the same time as the respective cash portions, while actual transfer of ownership takes place at the end of the retention period.

The shares, either as up-front or deferred portions, will be subject to taxation at the end of the retention period, taking into account the so-called normal value, corresponding to the arithmetic mean of official prices revealed thirty calendar days before the date on which the portions will be made available through transfer into the beneficiary’s portfolio.

Any rights and/or dividends are only vested at the end of the retention period, that is with reference to the period following the transfer to the recipient’s securities portfolio. In the case of extraordinary capital operations which provide for the exercising of an option right, the Board of Directors of the Parent Company may assess the resulting adjustments to any share portions that have vested but are not yet available to the beneficiaries.

Table contain breakdowns and amounts of bonus portions awarded, in relation to the year in which they come into the beneficiary’s effective possession.

Senior identified staff, in the case of an awarded incentive not of a particularlyhigh amount

Bonus awarding

2019 2020 2021 2022 2023 2024 2025 2026 1 year retention Up-front shares Up-front shares 30% 30%

1 year retention Up-front cash st st 30% 1 deferred shares 1 deferred shares 4,40% 4,40% 1 year retention st 1 deferred cash nd nd 3,60% 2 deferred shares 2 deferred shares 4,40% 4,40% 1 year retention 2nd deferred cash 3rd deferred shares 3rd deferred shares Accrual period 3,60% 4,40% 4,40% 1 year retention 3rd deferred cash 4th deferred shares 4th deferred shares 3,60% 4,40% 4,40% 1 year retention 4th deferred cash 5th deferred shares 5th deferred shares 3,60% 4,40% 4,40%

5th deferred cash 3,60%

Actualpayout 30% 33,6% 8% 8% 8% 8% 4,4% Senior identified staff or belonging to who reports directly tothe Italian subsidiarybanks’ CEO, in thecase of awarded incentive of a particularly high amount

Bonus awarding

2019 2020 2021 2022 2023 2024 2025 2026 1 year retention Up-front shares Up-front shares 20% 20%

1 year retention Up-front cash st st 20% 1 deferred shares 1 deferred shares 6,60% 6,60% 1 year retention st 1 deferred cash nd nd 5,40% 2 deferred shares 2 deferred shares 6,60% 6,60% 1 year retention 2nd deferred cash Accrual period 3rd deferred shares 3rd deferred shares 5,40% 6,60% 6,60% 1 year retention 3rd deferred cash 4th deferred shares 4th deferred shares 5,40% 6,60% 6,60% 1 year retention 4th deferred cash 5th deferred shares 5th deferred shares 5,40% 6,60% 6,60%

5th deferred cash 5,40%

Actualpayout 20% 25,40% 12% 12% 12% 12% 6,60%

Identified staff belonging to who reports directly to the Italian subsidiary banks’ CEO and other identified staff, in the case of awarded incentive not of a particularly high amount

Bonus awarding

2019 2020 2021 2022 2023 2024 1 year retention Up-front shares Up-front shares 30% 30% 1 year retention Up-front cash st st 30% 1 deferred shares 1 deferred shares 6,67% 6,67% 1 year retention st 1 deferred cash nd nd Accrual period 6,67% 2 deferred shares 2 deferred shares 6,67% 6,67% 1 year retention nd 2 deferred cash rd rd 6,67% 3 deferred shares 3 deferred shares 6,66% 6,66%

3rd deferred cash 6,66%

Actualpayout 30% 36,67% 13,34% 13,33% 6,66%

Other identified staff, in thecaseof an awarded incentive of a particularly high amount

Bonus awarding

2019 2020 2021 2022 2023 2024 1 year retention Up-front shares Up-front shares 20% 20% 1 year retention Up-front cash th st 20% 1 deferred shares 1 deferred shares 10% 10% 1 year retention th 1 deferred cash nd nd Accrual period 10% 2 deferred shares 2 deferred shares 10% 10% 1 year retention nd 2 deferred cash rd rd 10% 3 deferred shares 3 deferred shares 10% 10%

3rd deferred cash 10%

Actual payout 20% 30% 20% 20% 10%

Both up-front and deferred portions are subject to malus and claw-back provisions, according to that stated in paragraph 6.7 below, and do not correspond to cases of termination of contract or employment (apart from, prior to following agreement from the Parent Company for specific provisions contained in individual or collective contracts, in corporate agreements, that is by a unilateral corporate action, without however the necessary case by case evaluation, according to the time that the termination takes place). In accordance with the national bank procedures and with respect to the spirit of the current provisions, in cases where the awarded incentive is lower than or equal to the materiality threshold of 50,000 euro and, at the same time, lower than or equal to a third of the individual gross annual remuneration (GAR), this would be paid in cash and on a one-time basis. This provision does not apply to top identified staff (including senior identified staff), and those whose52 variable to fixed remuneration ratio53 exceeds 100%, to whom the regulation is always fully applied in terms of deferment and allocation of shares.

6.7. Malus and claw-back provisions

Payments of variable remuneration components are subject to the ex post correction system (so-called malus) described below:

1. the vesting of each deferred portion of the incentive is subject to total compliance with the consolidated entry gates and the relative threshold comparison values provided by the incentive system of the year preceding the year of the share’s vesting, in consideration of the Staff category belonging to the same year; this ex post correction system is, therefore, a provision that operates in the deferral period, before the effective vesting of deferred incentive portions.

The provision described in this point is applied to deferred incentive portions relating to the former Banco Popolare and Bipiemme banking groups, accrued in 2014, 2015 and 2016;

2. with reference to identified staff and all other staff, in the event of ascertained misconduct during the year, the Parent Company Board of Directors, for persons directly appointed by it, or the Chief Executive Officer of the Parent Company (or their proxy) for remaining persons, assesses the measure of the provision to be adopted (which can act in reduction or zeroing) with reference to the incentive and company bonus for the year, deferred portions of incentives for previous year accruable in the year at hand and any retention bonuses.

Misconduct is defined as follows:

 provision of suspension from office and from payment of remuneration starting from one day. Determines exclusion of cited percentages of variable remuneration components;

 conduct which does not comply with legal, regulatory or by-law provisions or with codes of ethics or conduct applicable to the bank, leading to a significant loss for the company or the Group or for customers;

 breaches54 of the requirements stated pursuant to article 26 or, when the entity is an interested party, pursuant to article 53 of the Consolidated Bank Law;

52 Ex ante. 53 See Paragraph 6.1 “Relationship between variable and fixed components of remuneration”. 54 For example in cases of breaches of professionalism, integrity and independence requirements.  violation of the obligation not to use personal hedging strategies or insurances on remuneration to undermine the risk alignment effects embedded in the remuneration arrangements;

 fraudulent or grossly negligent conduct causing damage to a company or the Group.

In the event of misconduct as described in point 2 here above, the Parent Company Board of Directors, for persons directly appointed by it, or the Chief Executive Officer of the Parent Company (or their proxy), for remaining persons, also reserve the right to activate mechanisms for the return of previously accrued amounts or portions thereof, of the company bonus and retention bonus for the year (claw-back clause), from the moment of accrual up to and including the successive five years.

With reference to the Group’s Staff and prior to award, the Parent Company’s Human Resources function, with the help of appropriate corporate functions, annually verifies the potential existence of conditions apt for determining the non-granting or return of already vested and/or paid amounts and evaluates cases to submit to the possible decision of the Parent Company’s Board of Directors, for persons directly appointed by said Body, or to the Chief Executive Officer of the Parent Company (or their proxy), in the case of remaining persons.

The company has the right to pay amounts that are objects of reclaim with those potentially due in any capacity to the entity concerned and in this case the payment will take place, following a decision made by the Parent Company’s Board of Directors, for directly appointed persons, or the Chief Executive Officer (or his proxy) for remaining persons, from the moment of the company notifying the entity concerned of the compensatory power, notwithstanding any other action provided for by law to be applied by the company.

6.8 Long-term incentive system (LTI)

In 2017, a long-term incentive system (LTI) was first implemented in the Group on a triennial basis, and is still in place, consistent with the targets of the 2016-2019 Strategic Plan. This choice results from the wish to link part of high-level managers’ remuneration to the shareholders’ interests of requiring the creation of value for the company over time.

In addition to the Chief Executive Officer and members of the Parent Company’s General Management, the scope of recipients of the LTI system, evaluated and validated by the same Chief Executive Officer, includes a limited number of managerial offices chosen on the basis of the position and/or the responsibility and impact of the activity on business.

The LTI system, prior to positive verification of conditions and targets stated in paragraph 6.8.1 below, provides for the award of an incentive (LTI incentive) that corresponds to ordinary shares of Banco BPM (“performance share”).

6.8.1 Connection between LTI incentive and results

The award of the LTI incentive is carried out in accordance with the guidelines issued from time to time by the Supervisory Authority and is subject to full compliance with predefined entry gates, made up of indicators and relative values to compare: - consolidated capital adequacy indicator: Common Equity Tier 1 (CET1) capital demand, having reached at least the minimum level required for 2019 indicated by the Central European Bank at the end of the 2018 Supervisory Review and Evaluation Process (SREP);

- consolidated liquidity adequacy indicator: Net Stable Funding Ratio (NSFR), having reached at least the minimum level required for 2019 indicated by the Central European Bank at the end of the 2018 Supervisory Review and Evaluation Process (SREP);

- consolidated profitability indicator: Profit from current operating activities before tax (net of non-recurring items) on 31/12/2019, positive.

Indicator Comparison value at a consolidated level for access to LTI incentive

≥ minimum level required for 2019 indicated Common Equity Tier1 (CET1) capital demand by the BCE at the end of the SREP of 2018

Net Stable Funding Ratio (NSFR) ≥ minimum level required for 2019 indicated by the BCE at the end of the SREP of 2018

Profit from current operating activities before tax > 0 (net of non-recurring items) on 31/12/2019

Notwithstanding the positive verification of the entry gates, the size of the LTI incentive is determined, on the basis of a performance matrix, on the value of the profitability risk-adjusted indicator Return on Risk Adjusted Capital (RORAC) achieved on 31/12/2019, which will be compared with the relevant Risk Target threshold (Strategic Plan 2019) provided in the RAF approved by the Board of Directors in the meeting of 10 February 2017, and with the value revealed in the three-year period of the Total Shareholder Return (TSR – source: Bloomberg) financial market indicator, which measures the value created by a company for its own shareholders, which will be compared in terms of relative positioning with respect to the peer group made up of the eight most highly capitalised banks (Intesa San Paolo, Unicredit, UBI Banca, Banca Popolare dell’Emilia Romagna, Credito Emiliano, Banca Popolare di Sondrio, Monte dei Paschi di Siena, Credito Valtellinese). If, over the course of the three-year period, extraordinary operations should occur (not only of a corporate nature) to the banks composing the peer group, or the data of one of these is not available at the end of the Strategic Plan’s period, the Board of Directors will evaluate the adjustment of the performance matrix in order to make it consistent with the new situation.

The combination of results achieved with regards to the above indicators determines the effective number of shares to award to the beneficiaries of the LTI system and may also lead to its nullification; specifically:

- the entire number of shares will be awarded if the RORAC value achieved is at least equal to the relative Risk Target threshold (2019 Industrial Plan) and simultaneously Banco BPM achieves first or second place in the TSR indicator;

- the number of shares will be nullified if the RORAC value achieved is lower than 70% of the relative Risk Target threshold (2019 Industrial Plan), namely if Banco BPM achieves lower than fifth place in the TSR indicator (median value); - the number of shares will be reduced in other cases, applying the percentage stated for the relative combination of RORAC and TSR results.

The following performance matrix outlines the ratios to apply based on the RORAC result achieved (R) and the position compared with the peer group in terms of the TSR result.

TSR vs peer group classification 6th, 7th, 8th or 5th 3rd or 4th 1st or 2nd 9th place out of 9 place out of 9 place out of 9 place out of 9

R ≥ RORAC Risk Target 70% 85% 100%

80% * RORAC Risk Target ≤ R < 0% 50% 70% 85% RORAC Risk Target 70% * RORAC Risk Target ≤ R ≤ 40% 50% 70% 80% * RORAC Risk Target

R < 70% * RORAC Risk Target 0%

The LTI incentive, quantified on the basis of results achieved and performance matrices, will be reduced by 33% for each year of the Strategic Plan’s duration, in the case of non- achievement of the performance of the MBO scheme of the annual incentive system; the LTI bonus may therefore be reduced until it reaches zero.

During the Strategic Plan’s reference period, the Shareholders’ Ordinary Meeting will have the authority, upon the Board of Directors’ proposal and following a favourable opinion from the Remuneration Committee, to evaluate potential revisions of objectives to which to attach the award of the incentive.

6.8.2 Payment of LTI incentive

The LTI incentive awarded in ordinary shares of Banco BPM is subdivided into an up-front portion, equal to 40%, and three equal annual portions, as a whole equal to 60%, deferred in the three-year period after the vesting of the up-front portion.

There is a retention period (selling restriction) on the shares vested of two years for the up-front shares and of one year for the deferred shares; for the latter, the retention period starts from the moment in which the deferred remuneration is vested. The effective transfer of ownership occurs at the end of the retention period.

Shares, both up-front and deferred portions, are taxed at the end of the retention period, taking into account the normal value, corresponding to the average price quoted in the thirty days prior to the attribution date on which each portion shall be made available, by transfer to the recipient’s portfolio.

With respect to the provisions of Art. 2357-ter of the Italian Civil Code, potential rights and/or dividends will accrue exclusively with reference to the period following the transfer of the recipient’s portfolio. In the case of extraordinary capital operations which provide for the exercising of an option right, the Board of Directors of the Parent Company may assess the resulting adjustments to any share portions that have vested but are not yet available to the beneficiaries.

The table represents the amount of LTI incentive shares awarded, with reference to the year of vesting and their effective entrance into the recipient’s possession.

LTI incentive award

2017 2018 2019 2020 2021 2022 2023 2024 Retention 2 years

Up-front shares Up-front shares 40% 40% 1 year retention

1st deferred shares 1st deferred shares 20% 20% Accrual period 1 year retention

2nd deferred shares 2nd deferred shares 20% 20% 1 year retention

3rd deferred shares 3rd deferred shares 20% 20%

Actualpayout 60% 20% 20%

6.8.3 Malus and claw-back provisions

The incentive is subject to the same malus and claw-back provisions provided by the Group’s remuneration policies in force from time to time for payment of incentives (annual incentive system).

The LTI incentive shall not be paid in cases of termination of employment (unless, with prior agreement by the Parent Company, for specific provisions contained in individual or collective contracts, in corporate agreements, that is by a unilateral corporate initiative, notwithstanding the case by case evaluation necessary, according to the time where the termination took place.

6.9 Termination of employment and pension provisions

6.9.1 Discretionary pension benefits

There are no discretionary pension benefits.

6.9.2 Amounts for early termination of employment The Ordinary Shareholder's Meeting of the Parent Company approves criteria for determining any amount to be agreed in case of early termination of employment, for all staff, including any limits set for said amount in terms of fixed remuneration annuity.

Said criteria and limits are applied to all Group companies; these are approved by the Shareholders’ Meeting of each subsidiary bank.

As provided for by Bank of Italy Supervisory Provisions agreements stipulated for early termination of employment do not include amounts determined by a court and arbitrary judgement, severance pay established by general employment contract legislation and indemnity for lack of notice. In the latter two cases, this holds true when the amount is determined according to limits established by legislation55.

The golden parachute is any agreement pertaining to identified staff.

Amounts for early termination of employment can be awarded up to a maximum limit of 24 months of fixed remuneration (excluding indemnity for lack of notice, determined by legislative provisions) and for up to a maximum value of 2.4 million (employee gross amount).

Subject to approval of criteria for determining remuneration to be awarded in case of early termination of employment by the Ordinary Shareholder's Meeting, including limits established to this effect, in terms of fixed remuneration annuity, the Parent Company has the unilateral right to establish agreements of this nature.

The award process requires that the Parent Company Human Resources function submits a report which:

 for persons directly appointed by the Parent Company Board of Directors, to the Remuneration Committee which in turn draws up the proposal for submission to the Board (with reference to internal control functions, said report is also assessed by the Internal Control and Risks Committees and by the Statutory Board of Auditors);

 for remaining persons, to the Chief Executive Officer (or their proxy).

For identified staff and all other employees, amounts are awarded in accordance with specifications here below, without prejudice to Bank of Italy Supervisory Provisions56.

The awarding of amounts for early termination of employment is subject to the ascertainment of conditions, with reference to the previous year and pertaining to the capital adequacy indicator at a consolidated level Common Equity Tier1 (CET1) ratio “phased-in” and the liquidity adequacy indicator at a consolidated level Liquidity Coverage Ratio (LCR) regulatory:

 in the presence of the profit in both indicators CET1 ratio and LCR regulatory greater than the relative Risk Tolerance threshold57 defined in the Risk Appetite Framework, the amount can be awarded;

 if the result of one of the indicators CET1 ratio or LCR regulatory is lower than the midpoint between relative Risk Capacity and Risk Tolerance thresholds57 (midpoint), it will not be possible to proceed with the award or issuing of amounts for early termination of employment;

 in remaining cases, if the result of one or both indicators CET1 ratio and LCR regulatory is lower or equal to the relative Risk Tolerance threshold57, but equal to or higher than the midpoint58, the Parent Company Board of Directors is required to decide on the availability of economic resources for the awarding of amounts for early termination of employment.

The table summarises conditions for the award of amounts for early termination of employment in relation to the results (R) achieved.

55 Said items do not constitute variable remuneration and are not subject to criteria and limits established by the Meeting. 56 See Section III, paragraphs 2.2.2 and 2.2.3. 57 Risk Tolerance threshold means the lower point of the tolerance area, in line with the RAF framework. 58 Without prejudice, in the case of CET1 ratio, to provisions for combined capital buffer requirement (see paragraph 6.4.4). LCR regulatory

Consolidated Midpoint59 ≤ R ≤ Risk R > Risk Tolerance R < Midpoint59 indicators Tolerance

The Parent Company BoD decides the R > Risk Tolerance Proceed with reward. potential availability No award.

” of economic n i resources. - d e

s The Parent Company The Parent company a

h 59 BoD decides the BoD decides the

p Midpoint ≤ R ≤ Risk

“ potential availability potential availability No award. Tolerance o i of economic of economic t a

r resources. resources.

1 T E C

R < Midpoint59 No award. No award. No award.

The amount is determined by considering all elements deemed relevant and in any case:

- circumstances which led to termination, taking into account company interest, also with the purpose of avoiding the threat of legal proceedings;

- roles covered and/or offices held during employment, also in terms of risks assumed by the person;

- duration of employment and role;

- savings as a result of early termination of employment.

The ascertainment of any fraudulent conduct or gross negligence in the three calendar years prior to termination (assessment of the significance of such offences is carried out by the Parent Company's Board of Directors in the case of directly appointed persons, or by the Chief Executive Officer of the Parent Company for all remaining persons) precludes the payment of any amounts for indemnity for early termination of employment. The Parent Company's Board of Directors, for persons directly appointed by it, or the Chief Executive Officer of the Parent Company, for all remaining persons, reserve the right to also assess any further misconduct60 ascertained during the three calendar years prior to termination.

The amount awarded to identified staff is calculated within the upper limit of the variable component to fixed component ratio with reference to the last year of employment, without prejudice to Bank of Italy61 Supervisory Provisions.

59 Midpoint between Risk Capacity and Risk Tolerance. 60 See paragraph 6.7. 61 See Section III, paragraphs 2.2.2 and 2.2.3. Bank of Italy Supervisory Provisions also provide a predefined formula, contained in the bank's remuneration policy and which defines the amount to be awarded for early termination of employment, within the context of an agreement between the bank and employees, at any stage of legal proceedings, for the resolution of a current or potential dispute. As provided for by Bank of Italy Supervisory Provisions, if defined by means of the application of said formula, the amount is not included in the calculation of the aforementioned upper limit of the variable/fixed ratio.

The formula adopted by Banco BPM with reference to identified staff requires the amount to be determined based on the following:

- for top identified staff: 24 months of fixed remuneration;

- for other identified staff with more than 10 years of seniority at the Group: 24 months of fixed remuneration;

- for other identified staff not included under previous points: 18 months of fixed remuneration.

Any reductions applied to amounts described in points here above consist of the following:

- setting to zero, upon ascertainment of fraudulent conduct or gross negligence in the three calendar years prior to termination. The seriousness of such conduct is assessed by the Parent Company Board of Directors, for subjects directly appointed by it, or by the Chief Executive Officer of the Parent Company (or their proxy), for remaining persons;

- 50% reduction if the employee has been operating in the Group for less than three calendar years at the moment of termination, or otherwise, a 25% reduction if at the moment of termination62 he/she has covered his/her current position for less than two calendar years.

Irrespective of the method used to define the amount, payment thereof occurs according to the same methods provided for by the annual incentive system, defined in remuneration policies in force on the date of termination, with reference to the last position for which payment of the amount was assessed, without prejudice to specific conditions provided for in Supervisory Provisions63 of the Bank of Italy. Therefore issuing occurs as follows:

- for remaining staff, in cash and on a one-time basis;

- for identified staff (golden parachute):

- in an up-front portion, amounting to 60% in the event the amount is lower than the particularly high amount established in remuneration64 policies in force on the award date, or 40% under all other circumstances;

- in five equal annual deferred portions, for senior identified staff, irrespective of the amount awarded, and for identified staff who report directly to the Chief Executive Officer of subsidiary Italian banks, in the event the awarded amount is equal or greater than the particularly high amount established in remuneration policies in force on the award date, or in three deferred portions in all remaining circumstances;

62 Also applies to any similar roles (by way of example, change of position in the first line of management). 63 See Section III, paragraphs 2.2.2 and 2.2.3. 64 See paragraph 6.6.2 - the up-front portion is vested at the termination of employment, within the time limits envisaged by individual agreements; deferred portions are vested annually, the first becoming effective at least twelve months from the payment date of the up-front portion, and subsequent payments at an equal amount of time from the allocation of the previous amount;

- with reference to the up-front portion, amounting to 50% in cash and 50% in Banco BPM ordinary shares;

- with reference to each deferred portion the part in Banco BPM ordinary shares amounts to 55% in the event deferment is spread over five years, or 50% in remaining cases;

- there is a retention period (sale restriction) on vested shares of one year. For deferred portions, the retention period starts from the moment deferred remuneration is vested. The vesting of the share portions takes place at the same time as the respective cash portions, while actual transfer of ownership takes place at the end of the retention period. The carrying-book value of the allocated shares, both of up-front and deferred portions, is equal to the so-called “normal value”, corresponding to the arithmetic mean of official prices revealed in the thirty calendar days preceding the date on which each share became available through their transfer to the recipient’s portfolio. Any rights and/or dividends are only vested with reference to the period following the transfer to the recipient’s securities portfolio;

- both for identified staff and remaining staff, only in the absence of ascertained fraudulent conduct or gross negligence committed by the terminated person. The ascertainment of such conduct, the assessment of the significance thereof is the remit of the Parent Company's Board of Directors, in the case of directly appointed persons, of the Chief Executive Officer of the Parent Company for remaining persons, determines the zeroing of portions which have not yet been paid (malus) and the return of previously paid ones (claw-back). This assessment takes into account a five year period starting from initial accrual.

With specific reference to any non-competition clauses or notice period extension clauses in employment contracts of identified staff as well as of remaining staff, as of 2019 the following provisions apply, without prejudice to specific conditions set forth by Bank of Italy Supervisory Provisions65:

- the award process is the same as the one established for amounts for early termination of employment;

- monthly payment is subject to ascertainment of capital and liquidity adequacy conditions in force for early termination of employment amounts, as described in this paragraph;

- payment is also subject to the absence of fraudulent conduct or gross negligence. The seriousness of such conduct is assessed by the Parent Company Board of Directors, for subjects directly appointed by said body, or by the Chief Executive Office of the Parent company (or their proxy), for remaining persons (malus). Under such circumstances, amount restrictions may also be considered (claw-back). Both malus and claw-back act

65 See Section III, paragraphs 2.2.2 and 2.2.3. on the payment of amounts with reference to the year in which ascertainment occurs; claw-back may be exercised as of issuing and for the next five years;

- the annual amount issued to a person identified as belonging to the identified staff category is calculated within the upper limit of the variable/fixed remuneration ratio for each year;

- should the total amount awarded during the year to a person identified as identified staff be higher than the materiality threshold66, it will be issued up to the equivalent amount of the up-front quota in cash for the full amount of awarded variable remuneration67.

66 See paragraph 6.6.2 67Incentive, company bonus, LTI incentive (the latter when and if awarded). SECTION II

Implementation of 2018 remuneration policies

1. Implementation of the remuneration policies in 2018

In the Banco BPM Banking Group (hereafter Group), the Parent Company’s Human Resources, Risks, Planning and Control, Administration and Budget, Compliance and Corporate Affairs Secretary functions worked together, each for their fields of competence, to define the remuneration policies for 2018 (hereafter the 2018 Policy), in compliance with the regulatory provisions in force and in line with the Board of Directors’ guidelines and the strategic objectives of the Group itself.

The 2018 Policy was defined by the Board of Directors and approved by the Ordinary General Shareholders’ Meeting on 07 April 2018 and also transposed and approved by the relevant Corporate Bodies of the subsidiary companies and made available on the website www.bancobpm.it ( Corporate Governance – Remuneration Policies Section).

Banco BPM – in its capacity as Parent Company – did not avail itself of external consultants for drawing up the 2018 Policy.

For definitions of terms used in Section II, please refer to the 2018 Policy.

1.1 Remuneration Committee

In 2018 the Committee met on nineteen occasions and all members attended. On average each meeting lasted approximately one hour.

The Committee: (i) acknowledged the results of the Job evaluation project, in line with managerial role mapping of the new organisation of Banco BPM; (ii) proposed introducing the maximum limit of up to 2:1 for the ratio between the variable and fixed components of remuneration for selected figures deemed to be strategic; (iii) examined the verification of conditions for accessing the variable component of remuneration for Group staff, for the implementation of the 2017 Policy; (iv) examined the Remuneration Plan based on shares - year 2017; (v) examined the 2018 Policy proposal and criteria for determining remuneration to be agreed in case of early termination of employment or early termination of office; (vi) examined the proposal for the Remuneration Plan based on shares: 2018 short-term incentive plan (annual); (vii) carried out an enquiry to verify performance levels achieved by the Chief Executive Officer with reference to objectives assigned for the year 2017; (viii) expressed its orientated on the remuneration of members of the Group's subsidiary banks and main subsidiary non-banking companies and carried out an enquiry into the renewal of compensation of the corporate bodies of ProFamily, Release and Banca Aletti; (ix) carried out enquiries to determine objectives of MBO 2018 of the CEO and relative maximum incentive; (x) fine-tuned the implementary interpretation of identification criteria for identified staff and the updating thereof; (xi) examined the MBO of identified staff; (xii) took part in the process for the appointment of new Audit and Compliance Managers, in coordination with the Internal Audit and Risks Committee and the Appointments Committee and played an advisory role with reference to remuneration to be awarded to two new Managers; (xiii) assessed the correct application of rules established by the 2017 Policy for variable remuneration of managers of company control functions; (xiv) carried out an enquiry to ascertain the maximum incentive to be associated with the short term incentive system of the General Manager, Co-General Managers and senior operational and executive managers of the Parent Company; (xv) analysed and assessed the extension of role allowances to additional roles, in compliance with provisions of the 2018 Policy; (xvi) received information from the Human Resources function on the drawing up of a final balance of the 2017 Incentive System and 2018 incentives of the Group's commercial network; (xvii) acknowledged the essential parts constituting the policy for identifying the risk takers and positively assessed the implemented process and the relative 2019 results; (xviii) received an extensive illustration of the main new contents of update 25 to Circular no. 285.

For the pursuit of its own activities it received all the information deemed necessary and the support of company functions involved. For 2018 it chose not to avail itself of external consultants.

As provided for by Committee Regulations and unless otherwise resolved, the following participated in Committee Meetings: the Risk Manager, the Compliance Manager and the Human Resources Manager. The Committee also invited other managers of the Bank, according to the Agenda discussed on a time to time basis.

The Statutory Auditor, specifically appointed to this effect, attended Committee meetings, without prejudice to the right of all members of the Statutory board of auditors to attend meetings, as established by Regulations.

1.2 Identification of the Group’s identified staff

The process for identifying identified staff was implemented via the combined application of qualitative and quantitative criteria – the Regulatory Technical Standards – produced by the European Bank Authority (RTS68), and also with the adoption of an internal criterion to identify the top identified staff69.

The Human Resources function of the Parent Company coordinated the activities, involving the Compliance, Organisation, Risks and Planning and Control functions, each for their fields of competence, of the Parent Company. The process, implemented at Group level, regarded all Group companies, and envisaged an assessment carried at company level for the Italian banks by the Parent Company (by virtue of existing outsourcing contracts) and took account of the organisational positions, the hierarchical levels, the remuneration brackets and the impact on the risks of all Group staff.

The perimeter of identified staff is updated on a quarterly basis.

For 2018, 208 people were identified as identified staff at Group level, corresponding to around 0.9% of staff, broken down into the following categories:

- top identified staff - 42 people, of which:

68 EU Regulation no. 604/2014. 69 Top identified staff: the CEO, General Manager, Co-General Managers and Managers in the first line of management of the Parent Company, the CEO, General Manager, Co-General Manager and Deputy General Manager (when present) of Banca Popolare di Milano, Aletti & C. Banca d’Investimento Mobiliare, Banca Akros, ProFamily and Società Gestione Servizi BP. - 35 not belonging to internal control functions;

- 7 belonging to internal control functions.

- other identified staff - 166 people, of which:

- 151 not belonging to internal control functions;

- 15 belonging to internal control functions.

Specifically 153 persons were identified in the Parent Company, 29 in Banca Akros and 17 in Banca Aletti.

In relation to the individuals identified based solely on quantitative criteria, the Parent Company did not adopt the exclusion procedure, as defined in Decision (EU) 2015/2218 of the European Central Bank dated 20 November 2015.

For newly identified persons, the Parent Company Human Resources function also (a) sent an individual letter in which it informed each person that he/she had been identified as identified staff, (b) requested a statement of commitment, in compliance with the applicable legislation and the policies of the Banco BPM Group regarding remuneration and incentives, not to adopt strategies of personal hedging or insurance on remuneration or on any other aspect that may alter or invalidate the risk-alignment effects of remuneration mechanisms and (c) for employees, it send a specific notification regarding the fact that the matter of remuneration is subject to specific Regulatory and Supervisory provisions, as well as to company Policies, in force from time to time, and to the legislative provisions that regulate the system; the latter notification represented (where necessary and as far as necessary) an adjustment of the individual employment contracts to bring them in line with the afore-mentioned legislation, as any departures or individual agreements that are considered non-compliant are to be considered as being replaced by law.

1.3 2018 Incentive System

In 2018, the incentive system in the Group was activated, in accordance with 2018 Policy provisions and in consideration of the business and/or organisational characteristics of each Group company.

For identified staff identified on the basis of their responsibilities receiving bonuses and for specific staff of the sales networks the MBO (Management by Objectives) method of appraisal was adopted, which envisaged the assignment, when starting the system, of individual and/or team objectives to compare with results achieved at the end of the year. In the remaining cases, the method of assessing performance via Managerial Appraisal was adopted, which entailed each manager informing his workers of the qualitative/quantitative objectives of the department/office and the assessment criteria of the same.

Each MBO included both performance objectives (economic, project-related or efficiency) and qualitative ones (customer satisfaction, the percentage of complaints, professional and/or managerial quality appraisal, compliance with the rules and regulations on controls and due diligence).

In addition, with regard to risk containment, the incentive system envisaged the assignment of an objective regarding the control of credit risk profiles to the sales networks, and for identified staff, the assignment of risk-based or risk-adjusted KPIs. 2. Information on remuneration

2.1 Remuneration paid to members of Corporate Bodies of the Parent Company and of the Group’s subsidiary companies

The remuneration policy implemented in 2018 for members of the Corporate Bodies of the Parent Company and of subsidiary companies did not involve the payment of any variable component associated with the incentive systems to members of Boards of Directors without individual contracts.

The total amount of remuneration of the Chairman of the Body with the function of strategic supervision of each of the Group banks did not exceed the fixed remuneration paid to the respective heads of the Body with management function. This policy therefore conformed to the current Bank of Italy Supervisory Provisions.

The following paragraphs provide the details of the remuneration amounts paid.

2.1.1 Remuneration paid to members of the Board of Directors and Executive Committee In 2018, the members of the Board of Directors, without specific individual contracts, received fixed remuneration differentiated according to their respective offices held on the Board itself (Chairman and Director) and on any Board Committees (Chairman and Committee Member).

In connection with the approval of the merger between the former Banco Popolare Soc. Coop. and the former Banca Popolare di Milano Scarl, the corresponding Shareholders’ Meetings held on 15 October 2016 decided to award the following fixed payments to the Board of Directors of Banco BPM, for the full period of their office (financial years 2017-2018- 2019), to be allocated on a pro rata temporis basis in relation to their actual term in office:

 gross annual emolument of 110,000 euro payable to each member of the Board,

 additional gross annual emolument of 50,000 euro for each member of the Executive Committee, in addition to the cost of third-party insurance cover for members of the Board of Directors.

For directors holding specific offices, in accordance with the provisions of article 22 of the Bylaws, the Board of Directors, on the proposal of the Remuneration Committee and having considered the opinion of the Board of Statutory Auditors, at a meeting held on 17 April 2018, established the following additional fixed components for the period that will end on the date of the Shareholders’ Meeting called to approve the financial statements as at 31 December 2018:

 a gross annual emolument of 450,000 euro payable for the office of Chairman of the Board of Directors;

 a gross annual emolument of 180,000 euro payable for the office of Senior Deputy Chairman of the Board of Directors;  a gross annual emolument of 140,000 euro payable for the office of Deputy Chairman of the Board of Directors;

 a gross annual emolument of 160,000 euro payable for the office of Chairman of the Executive Committee;

 a gross annual emolument of 90,000 euro payable for the office of Chairman of the Internal Audit and Risks Committee;

 a gross annual emolument of 45,000 euro payable for the office of member of the Internal Audit and Risks Committee;

 a gross annual emolument of 10,000 euro payable for the office of Chairman of the Related Parties Committee;

 a gross annual emolument of 5,000 euro payable for the office of member of the Related Parties Committee;

 a gross annual emolument of 20,000 euro payable for the office of Chairman of the Appointments Committee;

 a gross annual emolument of 10,000 euro payable for the office of member of the Appointments Committee;

 a gross annual emolument of 20,000 euro payable for the office of Chairman of the Remuneration Committee;

 a gross annual emolument of 10,000 euro payable for the office of member of the Remuneration Committee; to be paid in relation to the term of the role or responsibility of members concerned.

A third-party insurance policy and a cumulative occupational accidents policy are planned for members of the Board of Directors. For the sake of completeness of information, it is also noted that a life insurance policy in favour of the current Chairman of the Board of Directors is in effect. Neither variable components of the remuneration nor end-of-term in office payments have been envisaged for members of the Board of Directors without individual contracts.

The Chairman of the Board of Director’s emolument did not exceed the fixed remuneration collected by the Chief Executive Officer or the General Manager.

Gross annual remuneration (GAR) of the CEO approved at the Board of Directors meeting held on 14th March 2017, as proposed by the Remuneration Committee and with the favourable vote of all members of the Board of Statutory Auditors - determined that fixed remuneration of the CEO remained unchanged, in accordance with article 2389 of the Italian Civil Code and article 22.1 of the Bylaws.

With reference to objectives (Management By Objectives - MBO), in 2018 the Board of Directors resolved to award the Parent Company Chief Executive Officer the maximum incentive associated with the short-term incentive system, equal to Gross Annual Pay (GAR), upon the achievement of maximum performance levels established by the MBO70.

The CEO, a Group employee, was awarded the benefits envisaged for Group managers.

70 See paragraph 2.2.1 with reference to assigned MBO and performance levels achieved by the Chief Executive Officer. 2.1.2 Remuneration paid to members of the Board of Statutory Auditors All members of the Board of Statutory Auditors are entitled – in addition to reimbursement of expenses incurred due to their office – to an annual remuneration, which is determined by the Shareholders’ Meeting at the time of their appointment, at a fixed rate for the full term of their office.

In connection with the approval of the merger between the former Banco Popolare Soc. Coop. and the former Banca Popolare di Milano Scarl, the corresponding Shareholders’ Meetings held on 15 October 2016 decided to award the following fixed remuneration to the Board of Statutory Auditors of Banco BPM, for the full period of their office (financial years 2017- 2018-2019), to be paid on the basis of their actual term in office:

- a gross annual remuneration of 160,000 euro to the Chairman of the Board,

- a gross annual remuneration of 110,000 euro to every other standing statutory auditor, in addition to the cost of third-party insurance cover for the members of the Board of Statutory Auditors.

A third-party insurance policy and cumulative occupational accidents policy are planned for members of the Board of Statutory Auditors.

With regard to the Bank of Italy Supervisory Provisions, members of the Board of Statutory Auditors shall not receive any variable components of remuneration.

The Board of Statutory Auditors is not currently granted powers pursuant to Art. 6.1 b, Italian Legislative Decree no. 231/2001; Board of Directors of Banco BPM, in their meeting on 10 January 2017, considering not to make use of the authorities laid out in paragraph 4-bis of the same article mentioned above, in fact appointed a specific Supervisory Body (SB), assigning it the task of monitoring, among other things, the supervision and functioning of the organisational, management and monitoring model, and also of updating of the consequent powers and duties. The Parent Company’s SB provides for the appointment of a statutory auditor among its members; an additional gross annual remuneration of 28,000 euro is therefore given to this person for the office fulfilled in the SB.

2.1.3 Remuneration paid to members of the Corporate Bodies of subsidiary companies In 2018, in accordance with the principles stated by the Group’s remuneration policies, fixed remuneration varied in relation to respective offices fulfilled within the body to which they belonged was paid to members of Corporate Bodies of subsidiary companies, as well as potential reimbursement for costs incurred due to their office and any attendance fees, where resolved by the respective Shareholders’ Meetings.

For members of the Board of Directors without individual contracts, no variable remuneration component was envisaged or paid.

Employees of the Parent Company and the subsidiary companies received no remuneration for offices held to represent the Group in the Corporate Bodies of subsidiaries other than their own. Save as envisaged in the individual contracts, this remuneration was paid entirely to the relevant company by the company where the post was held.

To comply with the relevant provisions of the Bank of Italy, the remuneration policies defined for the members of the Boards of control did not envisage any variable component of remuneration associated with the incentive systems.

2.2 Variable remuneration to be paid in 2019

The Board of Directors of the Parent Company, with regard to the conditions envisaged in the 2018 Policy for access to the variable components of remuneration to be paid in 2019, on 6th February 2019, after acknowledging the opinion of the Remuneration Committee, verified the opening of the consolidated entry gates71 for access to the 2018 bonus pool (National Labour Collective Agreement); this condition also determines the vesting in 2019 of the deferred portions of bonuses relating to previous years) and with regard to the incentive system.

During the same session the Board of Directors also verified the maximum measure of consolidated economic resources to be awarded to staff as part of the short term incentive system and company bonus (National Labour Collective Agreement), in application of the risk adjusted return adjustment factor72; this factor determined a reduction of approximately 15% of the incentive system's economic resources.

2.2.1 The 2018 incentive system for the Parent Company Chief Executive Officer For 2018 performance objectives for the Chief Executive Officer regarded profitability, credit and asset quality, capital requirements, value created by the business for shareholders, qualitative aspects regarding management activity.

The amount of the incentive associated with 2018 objectives for the Chief Executive Officer can amount to a maximum of 100% of this gross annual remuneration (GAR), corresponding to maximum MBO performance.

With reference to effectively achieved performance73 the incentive to be awarded amounts to approximately 88% of his GAR.

Here below please find the detail relating to the degree of achievement of the individual objectives assigned for the year 2018:

Performance Area Criterion Objective Weight level

Profit from current operating activities before tax (net of Partially Profitability absolute 20% non-recurring items) achieved

71 Common Equity Tier 1 ratio (CET1 ratio), Liquidity Coverage Ratio (LCR) profit from current operating activities before tax (net of non-recurring items). 72 Specifically, an adjustment factor, the size of which is proportional to the consolidated value of the Return on Risk Adjusted Capital (RORAC) profitability indicator obtained at the end of the financial year in comparison with the relevant Risk Trigger and Risk Appetite thresholds defined in the scope of the Risk Appetite Framework for the financial year in question, is applied to the bonus pool as illustrated below. 73 Ex ante with respect to any equalisation. Quality of credit Higher than absolute Consolidated Gross NPL ratio74 15% and assets expected

Positioning of Banco BPM regarding the annual Capital improvement of the OCR (Overall Capital Requirement as Higher than relative75 15% Requirements established in the SREP Decision 2018) in relative terms expected compared to the requirement of the previous year74 Value created by Positioning of Banco BPM regarding Total Shareholder in line with the company for relative75 30% Return (TSR - source Bloomberg) expectations shareholders Qualitative Qualitative assessment of Chief Executive Officer aspects regarding management activities drawn up by the Chairman of the Higher than individual individual 20% Board of Directors, following consultation with the Board expected management itself activities

2.2.2 Company bonus The award of said bonus was correlated with conditions of the Group's economic sustainability in terms of capital and liquidity adequacy and profitability which, as illustrated in paragraph 2.2 here above, the Parent Company Board of Directors confirmed.

The agreement which defined the Company Bonus of the Banco BPM Group for the year 2018, stipulated within reference framework regulations (art. 48 National Labour Collective Agreement), will provide for the vesting of a pro capita amount of 700 euro in 2019, for staff in Professional Areas and in the Middle Management category (therefore excluding executive staff). The bonus can be allocated on the basis of individual choice criteria (“welfare” or “cash”) established by tax legislation in force.

2.3 Other types of remuneration

2.3.1 Welfare payment The significant and active involvement of employees in the implementary phase of the Group integration process also provided a basis for defining a reward for staff in Professional Areas or Middle Management (therefore excluding executive staff), amounting to 150 euro per capita, of a non-monetary nature, exclusively exploitable for welfare purposes.

2.3.2 Merit measures With regard to measures on remuneration aimed at finding a coherent relation between responsibility, professionalism, commitment, and level of remuneration of employees, in 2018, measures were taken on fixed remuneration corresponding to around 1.65 million euro (cost relating to 2018 on an annual basis).

2.3.3 Other remuneration measures The opportunity to activate stability clauses, non-competition clauses and extension of notice period extension clauses, mainly with the aim of retaining staff who maintain primary contact

74 Risk-based Objective in Risk Appetite Framework 75 Compared with similar bodies, as suggested by the EBA in its "Orientation regarding healthy remuneration policies" see point 194: "The measurement of absolute results must be established by the body based on its own strategy, including its risk profile and risk appetite. The measurement of relative results is required to compare results with similar internal persons (within the organisation) or external persons (similar bodies)." with customers or which hold key positions in the organisation; these clauses provide for monthly payments, with continuity of employment.

In 2018, 55 new non-competition clauses and 7 new notice period extension clauses were activated, for a total cost of approximately 0.81 million (with reference to 2018, on an annual basis).

2.3.4 Welfare and other non-monetary benefits In the overall framework of supplementary health and national insurance services and specifically within the scope of measures qualifying Group company welfare which aim to satisfy requirements of a social nature of staff and their family members, benefits of a non monetary nature occurred as follows:

- awarding of advantageous conditions to access banking and insurance services;

- phase in during 2019 and early 2020 of lunch voucher value;

- extension of the opportunity to use company catering services where present;

- confirmation of pre-existing regulations regarding benefits for disabled family members;

- the possibility for the children of staff to benefit from summer holiday camps and Christmas provisions.

Once more with reference to welfare measures, non-monetary benefits included economic subsidies for expenses incurred for prevention and treatment as well as protective measures against premature death or permanent invalidity of employees.

2.4 Welcome bonuses or severance paid to identified staff In 2018 a welcome bonus of 75,000 euro was awarded to a newly appointed executive at the Group. In 2018 twelve employees in the identified staff category terminated employment and no severance was recognised; in one case, a bank settlement provided for an amount as indemnity for lack of notice and therefore not "golden parachute".

With regard to the external directors of the Group, in 2018, there were five terminations of office without severance payments.

For detailed information please refer to the “Summary schedule referred to in Article 450 CRR (Regulation 2013/575 EU), paragraph 1, “h”, subparagraphs v) and vi) – Remuneration at start and end of employment”.

2.5 Focus on remuneration of over a million euro – as required by Article 450 CRR (Regulation 2013/575 EU), paragraph 1, letter “i” With reference to total gross remuneration for the 2018 financial year, we report that one person was awarded an amount at least equal to euro 1 million (in the remuneration bracket from 2 to 2.5 million).

2.6 Focus on remuneration of members of the Management Board – required by article 450 CRR (Regulation 2013/575 EU), paragraph 2 For detailed information please refer to the “Summary schedule referred to in Article 450 CRR (Regulation 2013/575 EU), paragraph 1 “j”. 3. Data transmission obligations

In 2018, the Parent Company fulfilled its obligations to transmit annually to the Bank of Italy data relative to remuneration76, as established in the Communication of 7 October 201477, issued in accordance with Article 75 of CRD IV and according to the EBA Guidelines78.

76 See Circular no. 285/2013 as amended. 77 See Bank of Italy Communication of 7 October 2014 regarding collection of remuneration data from banks and investment companies. 78 GL 2014/07 “Guidelines on the data collection exercise regarding high earners” and GL 2014/08 “Guidelines on the remuneration benchmarking exercise” issued on 16 July 2014. Part 2 – Information tables (gross amounts)

Information required by Bank of Italy Supervisory Provisions - Circular no. 285/2013, as amended, Part 1, Title IV, Chapter 2 “Remuneration and incentive policies and practices”, Section VI “Information and data transmission obligations”(data referring to the Parent Company and the subsidiaries, as defined in the 2017 Policy)

Tables as required by art. 450 CRR (Regulation 2013/575 EU), paragraph 1, letter “g” Aggregate quantitative information on remuneration, broken down by business areas (euro) Fixed remuneration Variable remuneration for 2018 Number of Welcome Business Areas Company Bonus beneficiaries of which Bonus and (1) Amount (National Labour (2) severance Incentive Severance (3) Collective payments Payments Agreement) Members of the Management Body 15 4,804,058 11,252 1,280,661 75,000 Members of the Management Body in its 52 3,488,789 supervisory function Investment Banking 1,773 122,131,259 130,233 7,192,141 1,035,724 92,207 Retail banking 17,333 876,022,254 437,277 32,011,659 10,964,745 397,554 Asset management 29 1,851,381 38 127,547 17,500 Corporate functions 3,475 192,471,471 211,822 6,880,152 2,149,579 13,529 Internal control functions 533 34,255,660 40,682 1,284,663 317,361 Others 178 8,864,390 8,301 389,842 44,757 Total 23,388 1,243,889,262 839,606 49,166,667 (4) 14,529,667 578,290 Notes: (1) Pursuant to EBA orientations on the exercise of benchmarking for remuneration purposes. (2) Staff who in 2018 were awarded remuneration based on work performance during the year belonging at companies belonging to the Banking Group (number of persons). (3) Fixed remuneration 2018 includes remuneration items as defined in the 2018 Policy. (4) Maximum amount that can be awarded to staff. Division into business areas was calculated using estimation criteria. Any portions of incentives from previous years due in the year are not included.

244 Table as required by art. 450 CRR (Regulation 2013/575 EU), paragraph 1, letter “h”, sub i) and ii) Fixed and variable remuneration components (euro)

Incentive system for 2018 (*) Company Fixed remuneration Bonus Risk takers of which up front portion of which deferred portions (National identified for the Number of Total Labour year Number of beneficiari Amount amount Shares Other Shares Other Collective beneficiaries es Cash Cash (2) (3) instruments (3) instruments Agreement) (1) Members of the Management 12 4,454,933 3 1,277,033 277,070 277,070 361,447 361,447 Body Members of the Manag. Body in 30 3,109,816 its supervisory function Investment 47 8,945,981 33 2,097,271 953,709 490,098 326,732 326,732 7,467 Banking Retail banking 78 12,421,698 39 1,627,272 1,022,191 259,321 172,880 172,880 16,800 Asset management Corporate 21 5,136,641 16 939,111 292,003 219,566 213,771 213,771 700 functions Internal control 18 13 230,535 52,857 52,857 3,500 functions 2,811,129 415,535 79,285 Others 2 327,395 1 42,550 42,550 Total 208 37,207,592 105 6,398,772 2,818,058 1,325,340 1,127,687 1,127,687 28,467 of which "Senior 16 4,645,529 14 1,679,707 492,351 451,101 368,128 368,128 Management" Notes: (1) Staff who in 2018, even for a fraction of the year, belonged to the category of identified staff of the Banking Group (number of persons). (2) Fixed remuneration 2018 includes remuneration items as defined in the 2018 Policy. (3) Countervalue in euro.

(*) Best estimate on date of Report publication, ex ante compared to any equalisation. Table as required by art. 450 CRR (Regulation 2013/575 EU), paragraph 1, letter “h”, sub iii) and iv) Deferred portions of variable remuneration (euro)

Deferred portions of variable remuneration relating to previous years

not vested Risk takers identified for the year (1) vested in 2019 (malus) vesting from 2020 (2)

of which of which of which of which of which of which shares shares shares monetary monetary monetary (number) (number) (number) Members of the Management Body 392,270 88,068 91,069 14,808 561,850 194,955 Members of the Management Body in its supervisory 13,716 960 function Investment Banking 406,441 72,116 206,411 73,118 Retail banking 403,198 53,018 50,685 12,962 103,997 40,865 Asset management Corporate functions 205,564 40,568 142,449 19,706 214,537 81,232 Internal control functions 117,603 14,548 53,056 4,140 25,535 7,342 Others 7,335 2,389 Total 1,538,792 269,278 344,594 54,005 1,112,330 397,512 of which "Senior Management" 353,588 77,647 107,020 14,826 302,492 117,194

Notes: (1) Staff who in 2018, even for a fraction of the year, belonged to the category of identified staff of the Banking Group. (2) Residual deferred portions (monetary and shares) which (i) will not be awarded following termination of employment or (ii) currently not allocated following precautionary removal from service. Table as required by Article 450 CRR (Regulation 2013/575 EU), paragraph 1, letter “h”, sub v) and vi)

Welcome bonus and severance payments (euro)

Welcome bonus Severance payments

Risk takers identified for the vested in 2018 awarded in 2018 paid in 2018 year (1) Number of total Number of total awarded of which highest Number of total of which beneficiaries amount beneficiaries amount variable amount beneficiaries amount variable

Members of the 1 75,000 1 11,252 11,252 1 11,252 Management Body Members of the Management Body in its supervisory function Investment Banking Retail banking 1 366 366 Asset management Corporate functions 3 2,078 1,703 2 1,715 Internal control functions 2 7,133 7,000 1 7,000 Others 1 2,955 2,955 1 2,955 Total 1 75,000 8 23,785 - 5 22,922 - of which "Senior 1 75,000 Management"

Notes: (1) Staff hired or terminated in 2018 and who belonged to the category of identified staff of the Banking Group. Table as required by art. 450 CRR (Regulation 2013/575 EU), paragraph 1, letter “j” Total remuneration for the Chairman of the management body in its supervisory function and for each member of the management body, for the General Manager, the Co-General Managers and the Deputy General Managers (euro)

For information on total remuneration of the Chairman of the body with strategic supervisory functions, each member of the body with management function, the General Manager and Co-General Managers of Banco BPM, please refer to tables here below as required by Issuers' Regulations.

Total Period in which office was remuneration for Surname and Name Office held Company held the office held during the period

Tarantini Graziano Chairman of the Board of Directors Banca Akros 01/01/2018 - 31/12/2018 150,000

Turrina Marco Federico CEO - General Manager Banca Akros 01/01/2018 - 31/12/2018 623,126 (*)

Aletti & C.Banca Investimento Coda Vittorio Chairman of the Board of Directors 01/01/2018 - 06/04/2018 39,452 Mobiliare Aletti & C.Banca Investimento Ambrosoli Umberto Chairman of the Board of Directors 06/04/2018 - 31/12/2018 110,068 Mobiliare Aletti & C.Banca Investimento Zancanaro Maurizio Chief Executive Officer 01/01/2018 - 25/10/2018 339,576 Mobiliare Aletti & C.Banca Investimento Varaldo Alessandro Chief Executive Officer 05/11/2018 - 31/12/2018 132,932 Mobiliare

(*) including the entire 2018 incentive estimated as a maximum amount which can be awarded on the date of Report publication. In compliance with the 2018 Policy, 40% of the incentive is deferred over three years: single portions will be vested in 2020, 2021 and 2022, subject to ascertainment of entry conditions required on a time to time basis. Tables complying with the provisions of CONSOB Resolution 11971/1999, as amended by CONSOB Resolution 18049/2011 (second part of section II of schedule 7-bis)

Table 1 – Remuneration paid to the members of management and supervisory boards, general managers and other executives with strategic responsibilities Remuneration paid to members of the Board of Directors (euro) (A) (B)(C)(D)(1) (2) (4)(3) (5) (7) (8)(6) Office held Period Period over which Fixed remunerationSurname and Remuneration for Variable non equity Non-monetary Other Total Fair Value Severance name in which office was held participation in remuneration benefits remuneration of payments office was committees equity held Bonuses Profit sharing remuneration and (2) other incentives Emoluments Attendance Lump sum Remuneration Fixed Total Fixed Attendance Total (1) resolved by the fees refunds pursuant to employment remuneration fees Shareholder's Art. 2389 remuneration Meeting

Chairman of the 01/01/2018- approv. 2019 FRATTA PASINI CARLO 450.000 450.000 450.000 Board of Directors 31/12/2018 Financial Statements

01/01/2018- approv. 2019 Director 110.000 110.000 110.000 31/12/2018 Financial Statements Chairman of the Charitable 01/01/2018- approv. 2018 Donations 31/12/2018 Financial Statements Committee (I) Remuneration in company which draws up the financial statements 110.000 450.000 560.000 560.000 (II) Remuneration from subsidiaries and associates (III) Total 110.000 450.000 560.000 560.000 Senior Deputy 01/01/2018- approv. 2019 PAOLONI MAURO Chairman of the 180.000 180.000 180.000 31/12/2018 Financial Statements Board of Directors 01/01/2018- approv. 2019 Director 110.000 110.000 110.000 31/12/2018 Financial Statements Member of the 01/01/2018- same duration as 50.000 50.000 50.000 Executive 31/12/2018 BoD MemberCommittee of the Charitable 27/03/2018- approv. 2018 Donations 31/12/2018 Financial Statements Committee (I) Remuneration in company which draws up the financial statements 160.000 180.000 340.000 340.000

Chairman of the 01/01/2018- approv. 2019 Board of Directors 15.000 2.250 25.000 42.250 42.250 31/12/2018 Financial Statements BIPIEMME VITA S.p.A.

Member of the Control and Risk 01/01/2018- approv. 2019 1.000 1.000 1.000 Committee 31/12/2018 Financial Statements BIPIEMME VITA S.p.A.

Chairman of the Board of Directors 01/01/2018- approv. 2019 BIPIEMME 10.000 2.000 20.000 32.000 32.000 31/12/2018 Financial Statements ASSICURAZIONI S.p.A. Member of the Control and Risk Committee 01/01/2018- approv. 2019 1.000 1.000 1.000 BIPIEMME 31/12/2018 Financial Statements ASSICURAZIONI S.p.A. (II) Remuneration from subsidiaries and associates 25.000 4.250 45.000 74.250 2.000 2.000 76.250 (III) Total 185.000 4.250 225.000 414.250 2.000 2.000 416.250 (A) (B)(C)(D)(1) (2) (4)(3) (5) (7) (8)(6) Office held Period Period over which Fixed remunerationSurname and Remuneration for Variable non equity Non-monetary Other Total Fair Value Severance name in which office was held participation in remuneration benefits remuneration of payments office was committees equity held Bonuses Profit sharing remuneration and (2) other incentives Emoluments Attendance Lump sum Remuneration Fixed Total Fixed Attendance Total (1) resolved by the fees refunds pursuant to employment remuneration fees Shareholder's Art. 2389 remuneration Meeting

Deputy Chairman 140.000 01/01/2018- approv. 2019 CASTELLOTTI GUIDO of the Board of 140.000 140.000 31/12/2018 Financial Statements Directors 01/01/2018- approv. 2019 110.000 Director 110.000 110.000 31/12/2018 Financial Statements Member of the 01/01/2018- same duration as Executive 50.000 50.000 50.000 31/12/2018 BoD Committee (I) Remuneration in company which draws up the financial statements 160.000 140.000 300.000 300.000 (II) Remuneration from subsidiaries and associates (III) Total 160.000 140.000 300.000 300.000 Deputy Chairman 01/01/2018- approv. 2019 COMOLI MAURIZIO of The Board of 140.000 140.000 140.000 31/12/2018 Financial Statements Directors 01/01/2018- approv. 2019 Director 110.000 110.000 110.000 31/12/2018 Financial Statements Member of the 01/01/2018- same duration as Executive 50.000 50.000 50.000 31/12/2018 BoD Committee (I) Remuneration in company which draws up the financial statements 160.000 140.000 300.000 300.000 Director VERA ASSICURAZIONI S.p.A. (former 01/01/2018- 28/03/2018 2.466 2.466 2.466 AVIPOP 28/03/2018 ASSICURAZIONI S.p.A.) Director VERA PROTEZIONE S.p.A. 01/01/2018- 28/03/2018 2.466 2.466 2.466 (former AVIPOP 28/03/2018 VITA S.p.A.)

Chairman VERA ASSICURAZIONI SpA 29/03/2018- approv. 2020 3.767 15.069 18.836 18.836 (former AVIPOP 31/12/2018 Financial Statements ASSICURAZIONI SpA) Chairman VERA PROTEZIONE SpA 29/03/2018- approv. 2020 3.767 15.069 18.836 18.836 (former AVIPOP 31/12/2018 Financial Statements VITA SpA) (II) Remuneration from subsidiaries and associates 12.466 30.137 42.603 42.603 (III) Total 172.466 200.274 342.603 342.603 Chief Executive 01/01/2018- approv. 2019 CASTAGNA GIUSEPPE Officer 31/12/2018 Financial Statements Member of the 1.200.000380.6801.200.000 51.688 (a) 620.6801.632.368 01/01/2018- same duration as Executive 31/12/2018 BoD Committee (I) Remuneration in company which draws up the financial statements 1.200.000 1.200.000 380.680 51.688 1.632.368 620.680 Chief Executive Officer ALETTI & C. 26/10/2018- BANCA DI 04/11/2018 (b) 04/11/2018 INVESTIMENTO MOBILIARE S.p.A. Director ALETTI & C. BANCA DI 06/04/2018- approv. 2020 (b) INVESTIMENTO 31/12/2018 Financial Statements MOBILIARE S.p.A.

(II) Remuneration from subsidiaries and associates (III) Total 1.200.000 1.200.000 380.680 51.688 1.632.368 620.680 (A) (B)(C)(D) (2)(1) (4)(3) (5) (7) (8)(6) Office held Period Period over which Fixed remunerationSurname and Remuneration for Variable non equity Non-monetary Other Total Fair Value Severance name in which office was held participation in remuneration benefits remuneration of payments office was committees equity held Bonuses Profit sharing remuneration and (2) other incentives Emoluments Attendance Lump sum Remuneration Fixed Total Fixed Attendance Total (1) resolved by the fees refunds pursuant to employment remuneration fees Shareholder's Art. 2389 remuneration Meeting

01/01/2018- approv. 2019 ANOLLI MARIO Director 110.000 110.000 110.000 31/12/2018 Financial Statements Member of the 01/01/2018- approv. 2019 Related Parties 5.000 5.000 5.000 31/12/2018 Financial Statements Committee Deputy Chairman of the Charitable 01/01/2018- approv. 2018 Donations 31/12/2018 financial statements Committee Chairman of the 01/01/2018- approv. 2019 Internal Audit and 90.000 90.000 90.000 31/12/2018 Financial Statements Risks Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 95.000 95.000 205.000

Deputy Chairman 01/01/2018- approv. 2018 SOCIETA' GESTIONE 10.000 15.000 25.000 25.000 31/12/2018 Financial Statements SERVIZI BP S.c.p.a.

Chairman of The Board of Directors 29/03/2018- approv. 2020 VERA Vita S.p.A. 3.425 17.123 20.548 20.548 31/12/2018 financial statements (formerly Popolare Vita S.p.A.)

(II) Remuneration from subsidiaries and associates 13.425 32.123 45.548 45.548 (III) Total 123.425 32.123 155.548 95.000 95.000 250.548 01/01/2018- approv. 2019 CERQUA MICHELE Director 110.000 110.000 110.000 31/12/2018 Financial Statements Member of 01/01/2018- approv. 2019 Appointments 10.000 10.000 10.000 31/12/2018 Financial Statements Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 10.000 10.000 120.000 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 10.000 10.000 120.000 01/01/2018- approv. 2019 110.000 D'ECCLESIA RITA LAURA Director 110.000 110.000 31/12/2018 Financial Statements Member of the 45.000 01/01/2018- approv. 2019 Internal Audit and 45.000 45.000 31/12/2018 Financial Statements Risks Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 45.000 45.000 155.000 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 45.000 45.000 155.000 01/01/2018- approv. 2019 FRASCAROLO CARLO Director 110.000 110.000 110.000 31/12/2018 Financial Statements Chairman 01/01/2018- approv. 2019 Appointments 20.000 20.000 20.000 31/12/2018 Financial Statements Committee Member of the Charitable 01/01/2018- approv. 2018 Donations 31/12/2018 Financial Statements Committee Member of the 01/01/2018- approv. 2019 Internal Audit and 45.000 45.000 45.000 31/12/2018 Financial Statements Risks Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 65.000 65.000 175.000 Chairman 01/01/2018- Approv. 2020 PROFAMILY 15.000 750 35.000 50.750 50.750 31/12/2018 Financial Statements S.p.A. (II) Remuneration from subsidiaries and associates 15.000 750 35.000 50.750 50.750 (III) Total 125.000 750 35.000 160.750 65.000 65.000 225.750 (A) (B)(C)(D) (2)(1) (4)(3) (5) (7) (8)(6) Office held Period Period over which Fixed remunerationSurname and Remuneration for Variable non equity Non-monetary Other Total Fair Value Severance name in which office was held participation in remuneration benefits remuneration of payments office was committees equity held Bonuses Profit sharing remuneration and (2) other incentives Emoluments Attendance Lump sum Remuneration Fixed Total Fixed Attendance Total (1) resolved by the fees refunds pursuant to employment remuneration fees Shareholder's Art. 2389 remuneration Meeting

GALBIATI PAOLA 01/01/2018- approv. 2019 Director 110.000 110.000 110.000 ELISABETTAMARIA 31/12/2018 Financial Statements Member of 01/01/2018- approv. 2019 Remuneration 10.000 10.000 10.000 31/12/2018 Financial Statements Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 10.000 10.000 120.000 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 10.000 10.000 120.000 01/01/2018- approv. 2019 GALEOTTI CRISTINA Director 110.000 110.000 110.000 31/12/2018 Financial Statements Member of the Charitable 27/03/2018- approv. 2018 Donations 31/12/2018 Financial Statements Committee Chairman of 04/08/2018- approv. 2019 Related Parties 4.083 4.083 (c) 4.083 31/12/2018 Financial Statements Committee Member of 01/01/2018- approv. 2019 Appointments 10.000 10.000 10.000 31/12/2018 Financial Statements Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 14.083 14.083 124.083 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 14.083 14.083 124.083 01/01/2018- approv. 2019 GOLO MARISA Director 110.000 110.000 110.000 31/12/2018 Financial Statements Member of the 01/01/2018- approv. 2019 Related Parties 5.000 5.000 5.000 31/12/2018 Financial Statements Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 5.000 5.000 115.000 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 5.000 5.000 115.000 01/01/2018- approv. 2019 LONARDI PIERO SERGIO Director 110.000 110.000 110.000 31/12/2018 Financial Statements Member of the Charitable 27/03/2018- approv. 2018 Donations 31/12/2018 Financial Statements Committee Member of the 01/01/2018- same duration as Executive 50.000 50.000 50.000 31/12/2018 BoD Committee (I) Remuneration in company which draws up the financial statements 160.000 160.000 160.000 Director of BIPIEMME 01/01/2018- approv. 2019 10.000 2.000 12.000 12.000 ASSICURAZIONI 31/12/2018 Financial Statements S.p.A. (II) Remuneration from subsidiaries and associates 10.000 2.000 12.000 12.000 (III) Total 170.000 2.000 172.000 172.000 01/01/2018- approv. 2019 PEDROLLO GIULIO Director 110.000 110.000 110.000 31/12/2018 Financial Statements Member of the Charitable 01/01/2018- approv. 2018 Donations 31/12/2018 Financial Statements Committee Member of 01/01/2018- approv. 2019 Appointments 10.000 10.000 10.000 31/12/2018 Financial Statements Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 10.000 10.000 120.000 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 10.000 10.000 120.000 (A) (B)(C)(D) (2)(1) (4)(3) (5) (7) (8)(6) Office held Period Period over which Fixed remunerationSurname and Remuneration for Variable non equity Non-monetary Other Total Fair Value Severance name in which office was held participation in remuneration benefits remuneration of payments office was committees equity held Bonuses Profit sharing remuneration and (2) other incentives Emoluments Attendance Lump sum Remuneration Fixed Total Fixed Attendance Total (1) resolved by the fees refunds pursuant to employment remuneration fees Shareholder's Art. 2389 remuneration Meeting

01/01/2018- approv. 2019 RAVANELLI FABIO Director 110.000 110.000 110.000 31/12/2018 Financial Statements Remuneration 01/01/2018- approv. 2019 Committee 20.000 20.000 20.000 31/12/2018 Financial Statements (Chairman) (I) Remuneration in company which draws up the financial statements 110.000 110.000 20.000 20.000 130.000 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 20.000 20.000 130.000

SAVIOTTI PIER FRANCESCO 01/01/2018- approv. 2019 Director 110.000 110.000 110.000 (3) 31/12/2018 Financial Statements Member and Chairman of 01/01/2018- same duration as 50.000 160.000 210.000 210.000 Executive 31/12/2018 BoD Committee (I) Remuneration in company which draws up the financial statements 160.000 160.000 320.000 320.000 Director BANCA 01/01/2018- Approv. 2019 20.000 20.000 20.000 AKROS S.p.A. 31/12/2018 Financial Statements (II) Remuneration from subsidiaries and associates 20.000 20.000 20.000 (III) Total 180.000 160.000 340.000 340.000 01/01/2018- approv. 2019 SOFFIENTINI MANUELA Director 110.000 110.000 110.000 31/12/2018 Financial Statements Member of 01/01/2018- approv. 2019 Remuneration 10.000 10.000 10.000 31/12/2018 Financial Statements Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 10.000 10.000 120.000 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 10.000 10.000 120.000 01/01/2018- approv. 2019 TORRICELLI COSTANZA Director 110.000 110.000 110.000 31/12/2018 Financial Statements Member of the 01/01/2018- approv. 2019 Related Parties 5.000 5.000 5.000 31/12/2018 Financial Statements Committee Member of the Charitable 01/01/2018- approv. 2018 Donations 31/12/2018 Financial Statements Committee Member of the 01/01/2018- approv. 2019 Internal Audit and 45.000 45.000 45.000 31/12/2018 Financial Statements Risks Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 50.000 50.000 160.000 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 50.000 50.000 160.000 01/01/2018- approv. 2019 ZUCCHETTI CRISTINA Director 110.000 110.000 110.000 31/12/2018 Financial Statements Chairman of 01/01/2018- Related Parties 03/08/18 5.917 5.917 5.917 (d) 03/08/2018 Committee Member of 01/01/2018- approv. 2019 Remuneration 10.000 10.000 10.000 31/12/2018 Financial Statements Committee (I) Remuneration in company which draws up the financial statements 110.000 110.000 15.917 15.917 125.917 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 15.917 15.917 125.917 Notes:

(1) This value corresponds to what is specified in Table 3B regarding the sum of: (i) disbursable bonus portions for the year; (ii) disbursable bonus portions for previous years; (iii) other bonuses. (2) These values correspond to what is specified in Table 3A regarding the "Fair Value" of financial instruments for the year and also includes the fair value of shares with reference to the long term incentive system 2017-2019 (LTI), as estimated in the 2018 Financial Statements. Recipients of the LTI system are not yet the legal owners of relative shares and will only come into the ownership thereof following the outcome of verifications carried out during the vesting period. Said verifications may determine the reduction or even zeroing of shares: in 2020 verification of entry gates 2019 and performance levels achieved during the three-year period 2017-2019; in 2021, 2022 and 2023 verification, respectively, of consolidated entry gates 2020, 2021 and 2022. (3) As specified in tables 3A and 3B, in 2019 the deferred portion of the 2015 incentive system will be vested for the position held by Mr. Pier Francesco Saviotti in the former Banco Popolare Group. (a) Total amount for pension fund, health care, car, accident insurance. (b) Remuneration paid by the Company to Banco BPM S.p.A. (c) Appointed by the Board of Directors 3rd August 2018, to replace the resigning Ms Cristina Zucchetti. (d) Resigned on August 3rd 2018. Table 1 – Remuneration paid to the members of management and supervisory boards, general managers and other executives with strategic responsibilities Remuneration paid to members of the Board of Statutory Auditors (euro)

(A) (B)(C)(D) (2)(1) (4)(3) (5) (7) (8)(6) Office held Period Period over which Fixed remunerationSurname and Remuneration for Variable non equity Non-monetary Other Total Fair Value Severance name in which office was held participation in remuneration benefits remuneration of payments office was committees equity held Bonuses Profit sharing remuneration and other incentives Emoluments Attendance Lump sum Remuneration Fixed Total Fixed Attendance Total resolved by the fees refunds pursuant to employment remuneration fees Shareholder's Art. 2389 remuneration Meeting

Chairman of the 01/01/2018- approv. 2019 PRIORI MARCELLO Board of Statutory 160.000 160.000 160.000 31/12/2018 Financial Statements Auditors (I) Remuneration in company which draws up the financial statements 160.000 160.000 160.000 Chairman of the Board of Statutory 01/01/2018- Approv. 2018 Auditors 45.900 45.900 45.900 31/12/2018 Financial Statements BANCA AKROS S.p.A. Standing Auditor ALETTI & C. 01/01/2018- Approv. 2020 BANCA DI 35.000 35.000 35.000 31/12/2018 Financial Statements INVESTIMENTO MOBILIARE S.p.A.

Chairman of the Board of Statutory 01/01/2018- Approv. 2019 50.000 50.000 50.000 Auditors 31/12/2018 Financial Statements BIPIEMME VITA S.p.A.

Standing Auditor BIPIEMME 01/01/2018- Approv. 2019 16.000 16.000 16.000 ASSICURAZIONI 31/12/2018 Financial Statements S.p.A. (II) Remuneration from subsidiaries and associates 146.900 146.900 146.900 (III) Total 306.900 306.900 306.900 01/01/2018- approv. 2019 MOSCONI MARIA LUISA Standing Auditor 110.000 110.000 110.000 31/12/2018 Financial Statements (I) Remuneration in company which draws up the financial statements 110.000 110.000 110.000

Standing Auditor 16/05/2018- Approv. 2018 18.863 18.863 18.863 BANCA AKROS S.p.A 31/12/2018 Financial Statements

(II) Remuneration from subsidiaries and associates 18.863 18.863 18.863 (III) Total 128.863 128.863 128.863 (A) (B)(C)(D) (2)(1) (4)(3) (5) (7) (8)(6) Office held Period Period over which Fixed remunerationSurname and Remuneration for Variable non equity Non-monetary Other Total Fair Value Severance name in which office was held participation in remuneration benefits remuneration of payments office was committees equity held Bonuses Profit sharing remuneration and other incentives Emoluments Attendance Lump sum Remuneration Fixed Total Fixed Attendance Total resolved by the fees refunds pursuant to employment remuneration fees Shareholder's Art. 2389 remuneration Meeting

01/01/2018- approv. 2019 ERBA GABRIELE CAMILLO Standing Auditor 110.000 110.000 110.000 31/12/2018 Financial Statements (I) Remuneration in company which draws up the financial statements 110.000 110.000 110.000

Standing Auditor 01/01/2018- Approv. 2020 10.000 10.000 10.000 RELEASE S.p.A. 31/12/2018 Financial Statements

Member of Supervisory Board pursuant to Italian 01/01/2018- Approv. 2020 500500500 Legislative Decree 31/12/2018 Financial Statements 231/01 RELEASE S.p.A.

Standing Auditor 01/01/2018- Approv. 2019 50.00025.00025.000 50.000 ALBA LEASING S.p.A. 31/12/2018 Financial Statements

Standing Auditor 01/01/2018- Approv. 2019 BP PROPERTY 10.00010.00010.000 31/12/2018 Financial Statements MANAGEMENT Scrl

Member of Supervisory Board pursuant to Italian 01/01/2018- approv. 2019 Legislative Decree 500 500 500 31/12/2018 Financial Statements 231/01 BP PROPERTY MANAGEMENT Scrl (II) Remuneration from subsidiaries and associates 45.000 25.000 70.000 1.000 1.000 71.000 (III) Total 155.000 25.000 180.000 1.000 1.000 181.000 01/01/2018- approv. 2019 ROSSI CLAUDIA Standing Auditor 110.000 110.000 110.000 31/12/2018 Financial Statements (I) Remuneration in company which draws up the financial statements 110.000 110.000 110.000 (II) Remuneration from subsidiaries and associates (III) Total 110.000 110.000 110.000 (A) (B)(C)(D) (2)(1) (4)(3) (5) (7) (8)(6) Office held Period Period over which Fixed remunerationSurname and Remuneration for Variable non equity Non-monetary Other Total Fair Value Severance name in which office was held participation in remuneration benefits remuneration of payments office was committees equity held Bonuses Profit sharing remuneration and other incentives Emoluments Attendance Lump sum Remuneration Fixed Total Fixed Attendance Total resolved by the fees refunds pursuant to employment remuneration fees Shareholder's Art. 2389 remuneration Meeting

01/01/2018- approv. 2019 ALFONSO SONATO Standing Auditor 110.000 110.000 110.000 31/12/2018 Financial Statements

Member of the approv. Financial Supervisory Board 01/01/2018- Statements 2019 (up pursuant to Italian 28.000 28.000 28.000 31/12/2018 to term of office as Legislative Decree Standing Auditor) 231/01

(I) Remuneration in company which draws up the financial statements 110.000 110.000 28.000 28.000 138.000 Chairman of the Board of Statutory Auditors 01/01/2018- Approv. 2020 50.000 50.000 50.000 ALETTI & C. BANCA 31/12/2018 Financial Statements DI INVESTIMENTO MOBILIARE S.P.A. Member of the Supervisory Board pursuant to Legislative Decree 01/01/2018- Approv. 2020 11.200 11.200 11.200 231/01 31/12/2018 Financial Statements ALETTI & C. BANCA DI INVESTIMENTO MOBILIARE S.P.A.

Standing Auditor 01/01/2018- Approv. 2019 BP PROPERTY 10.000 10.000 10.000 31/12/2018 Financial Statements MANAGEMENT Scrl

Member of the Supervisory Board pursuant to 01/01/2018- Approv. 2019 Legislative Decree 500 500 500 31/12/2018 Financial Statements 231/01 BP PROPERTY MANAGEMENT Scrl (II) Remuneration from subsidiaries and associates 60.000 60.000 11.700 11.700 71.700 (III) Total 170.000 170.000 39.700 39.700 209.700 Table 1 – Remuneration paid to the members of management and supervisory boards, general managers and other executives with strategic responsibilities Remuneration paid to members of General Management (euro) (A) (B)(C)(D) (2)(1) (4)(3) (5) (7) (8)(6) Office held Period Period over which Fixed remunerationSurname and Remuneration for Variable non equity Non-monetary Other Total Fair Value Severance name in which office was held participation in remuneration benefits remuneration of payments office was committees equity held Bonuses Profit sharing remuneration and (2) other incentives (1) Emoluments Attendance Lump sum Remuneration Fixed Total Fixed Attendance Total resolved by the fees refunds pursuant to employment remuneration fees Shareholder's Art. 2389 remuneration Meeting

01/01/2018- FARONI MAURIZIO Manager 31/12/2018 indefinite duration 700.000700.000 (*) 5.463 (a) 705.463 98.000 01/01/2018- General Manager 31/12/2018 (I) Remuneration in company which draws up the financial statements 700.000 700.000 5.463 705.463 98.000 Director ALETTI & C. BANCA DI 06/04/2018- 05/11/18 (b) INVESTIMENTO 05/11/2018 MOBILIARE S.p.A.

Director ALETTI & C. BANCA DI 23/11/2018- first meeting (b) INVESTIMENTO 31/12/2018 (co-opted) MOBILIARE S.p.A.

Director BANCA 01/01/2018- Approv. 2019 (b) AKROS S.p.A. 31/12/2018 Financial Statements (II) Remuneration from subsidiaries and associates (III) Total 700.000 700.000 5.463 705.463 98.000 01/01/2018- DE ANGELIS DOMENICO Manager 31/12/2018 indefinite duration 700.000 700.000 156.385 28.532 (a) 884.917 151.753 Co-General 01/01/2018- Manager 31/12/2018 (I) Remuneration in company which draws up the financial statements 700.000 700.000 156.385 28.532 884.917 151.753 Director BANCA 01/01/2018- POPOLARE DI 26/11/18 (b) 26/11/2018 MILANO S.p.A. (II) Remuneration from subsidiaries and associates (III) Total 700.000 700.000 156.384,93 28.532 884.917 151.753 01/01/2018- POLONI SALVATORE Manager 31/12/2018 indefinite duration 450.000 450.000 107.214 17.320(a) 179.214574.534 Co-General 01/01/2018- Manager 31/12/2018 (I) Remuneration in company which draws up the financial statements 450.000 450.000 107.214 17.320 574.534 179.214

Chairman of BoD No 29/03/2018- Approv. 2020 BP PROPERTY remuneration 31/12/2018 Financial Statements MANAGEMENT S provided for

Director BANCA 01/01/2018- POPOLARE DI 26/11/18 (b) 26/11/2018 MILANO S.p.A. Director BANCA 01/01/2018- Approv. 2019 (b) AKROS S.p.A. 31/12/2018 Financial Statements Director SOCIETA' 01/01/2018- Approv. 2018 GESTIONE SERVIZI BP (b) 31/12/2018 Financial Statements Soc.Co (II) Remuneration from subsidiaries and associates (III) Total 450.000 450.000 107.214 17.320 574.534 179.214 Notes:

(1) This value corresponds to what is specified in Table 3B regarding the sum of: (i) disbursable bonus portions for the year; (ii) disbursable bonus portions for previous years; (iii) other bonuses. (2) These values correspond to what is specified in Table 3A regarding the "Fair Value" of financial instruments for the year and also includes the fair value of shares with reference to the long term incentive system 2017-2019 (LTI), as estimated in the 2018 Financial Statements. Recipients of the LTI system are not yet the legal owners of relative shares and will only come into the ownership thereof following the outcome of verifications carried out during the vesting period. Said verifications may determine the reduction or even zeroing of shares: in 2020 verification of entry gates 2019 and performance levels achieved during the three-year period 2017-2019; in 2021, 2022 and 2023 verification, respectively, of consolidated entry gates 2020, 2021 and 2022. (*) Following the occurrence of the precautionary removal from the service, the shares vested during the financial year are not currently assigned. (a) Total amount for pension fund, health care, car, accident insurance. (b) Remuneration paid by the Company to Banco BPM S.p.A. Table 1 – Remuneration paid to the members of management and supervisory boards, general managers and other executives with strategic responsibilities Remuneration paid to other executives with strategic responsibilities (euro)

(1) (2) (3) (4) (5) (6) (7) (8)

Fixed remuneration Remuneration for Variable non equity Non- Other Total FairValue Severance participation in remuneration monetary remuneration of payments committees benefits equity Bonuses and Profit sharing (1) remuneration other 11 OTHER EXECUTIVES WITH STRATEGIC RESPONSIBILITIES (3) Emoluments Attendance Lump sum Remuneration Fixed Total Fixed Attendance Total incentives resolved by the fees refunds pursuant to Art. employment remuneration fees (2) Shareholder's 2389 remuneration Meeting (1)

(I) Remuneration in company which draws up the financial statements 2.763.038 2.763.038 562.755 98.585 3.424.379 523.224 (II) Remuneration from subsidiaries and associates (4) (III) Total 2.763.038 2.763.038 562.755 98.585 3.424.379 523.224

Notes: (1) Includes entire fixed remuneration paid in 2018, also for those identified for a fraction of the year. (2) This value corresponds to what is specified in Table 3B regarding the sum of: (i) disbursable bonus portions for the year; (ii) disbursable bonus portions for previous years; (iii) other bonuses. (3) These values correspond to what is specified in Table 3A regarding the "Fair Value" of financial instruments for the year and also includes the fair value of shares with reference to the long term incentive system 2017-2019 (LTI), as estimated in the 2018 Financial Statements. Recipients of the LTI system are not yet the legal owners of relative shares and will only come into the ownership thereof following the outcome of verifications carried out during the vesting period. Said verifications may determine the reduction or even zeroing of shares: in 2020 verification of access gate 2019 and performance levels achieved during the three-year period 2017- 2019; in 2021, 2022 and 2023 verification, respectively, of consolidated access gates 2020, 2021 and 2022. (4) For the offices held on the Boards of Directors of the subsidiaries representing the Group, any remuneration was paid by the Companies to Banco BPM SpA. Table 3A: Incentive plans based on financial instruments, other than stock-options, payable to the members of the management board, general managers and other executives with strategic responsibilities (euro) Please note that the parties indicated in the table (by name or in aggregate form) are not yet legitimate owners of the Banco BPM shares indicated, but will become owners during the vesting period only in the case of satisfaction of the predefined conditions for each individual plan. Financial instruments FinancialinstrumentsassignedduringtheyearF inancial Financialinstruments F inancial assigned in previous instruments assigned during the year and instruments for the years and not vested vested grantable year during the financial year during the (1) (2) year and no t granted

(A) (B) (1) (2) (3) (4)(5) (6) (7) (8) (9) (10) (11) (12)

Surnameandname Officeheld Plan N umber and Vesting Number and type Fair value at Vesting Granting date Market price at N umber and N umber and Value at the F air value (3) type o f P erio d of financial the granting P erio d the granting type o f type o f vesting date financial instruments date date financial financial (5) instruments (4) instruments instruments

Chief Executive Officer CASTAGNAGIUSEPPE BANCOBPM

(I) Remuneration in company which draws up the financial statements 675.445

LTI (2017-2019) Ordinary 2017-2023 240.000 (8/04/2017) Shares of Banco BPM

N.D. N.D. 2018 (7/04/2018) Ordinary Shares of N.D. Ordinary Shares of 212.080 212.080530.200 2018-2024 27/06/2019 (a) Banco BPM Banco BPM

57.898 14.475

2017 Ordinary 2017-2023 Ordinary Shares of 30.686 34.800 (8/04/2017) Shares of Banco BPM Banco BPM

44.087 14.695 2016 former Bipiemme Group Ordinary 2016-2022 31.152 45.000 Ordinary Shares of (30/04/2016) Shares of Banco BPM Banco BPM

38.272 19.135

2015 Ordinary former Bipiemme Group 2015-2021 Ordinary Shares 40.564 48.000 Shares Banco (11/04/2015) Banco BPM BPM (b) (b)

6.677 6.677 2014 former Bipiemme Group Ordinary 2014-2020 Ordinary Shares 14.155 40.800 (12/04/2014) Shares Banco Banco BPM (c) BPM (b) (b) (II) Remuneration from subsidiaries and associates (III) Total 822.379 530.200 54.982 328.636 620.680 Financial instruments FinancialinstrumentsassignedduringtheyearF inancial Financialinstruments F inancial assigned in previous instruments assigned during the year and instruments for the years and not vested vested grantable year during the financial year during the (1) (2) year and no t granted

(A) (B) (1) (2) (3) (4)(5) (6) (7) (8) (9) (10) (11) (12)

Surnameandname Officeheld Plan N umber and Vesting Number and type Fair value at Vesting Granting date Market price at N umber and N umber and Value at the F air value (3) type o f P erio d of financial the granting P erio d the granting type o f type o f vesting date financial instruments date date financial financial (5) instruments (4) instruments instruments

General Manager Banco FARONIMAURIZIO B PM S.p.A.

(I) Remuneration in companywhich draws up the financial statements 275.807 LTI (2017-2019) Ordinary (8/04/2017) Shares of 2017-2023 98.000 (d) Banco BPM

35.290 8.823 2017 Ordinary Ordinary Shares (8/04/2017) Shares of 2017-2023 (e) of Banco BPM (d) Banco BPM

6.003 2015 Ordinary Shares former Banco Popolare Banco BPM (g) Group (f) (19/03/2016)

(II) Remuneration from subsidiaries and associates (III) Total 311.097 14.826 98.000

Co-General Manager DEANGELISDOMENICO Banco BPM

(I) Remuneration in companywhich draws up the financial statements 202.633

LTI (2017-2019) Ordinary 72.0002017-2023 (8/04/2017) Shares of Banco BPM

N.D. N.D. 2018 (7/04/2018) 104.588 2018-2022 27/06/2019 62.753N.D. 62.753 (a) Ordinary Shares of OrdinaryShares of B anco BPM B anco BPM

14.142 7.071 2017 Ordinary 2017-2021 OrdinaryShares of 14.990 17.000 (8/04/2017) Shares of B anco BPM Banco BPM

5.361 2015 former Banco Popolare Group Ordinary Shares 11.365 (g) (19/03/2016) B anco BPM (f)

(II) Remuneration from subsidiaries and associates (III) Total 216.775 104.588 12.432 89.107 151.753 Financial instruments FinancialinstrumentsassignedduringtheyearF inancial Financialinstruments F inancial assigned in previous instruments assigned during the year and instruments for the years and not vested vested grantable year during the financial year during the (1) (2) year and no t granted

(A) (B) (1) (2) (3) (4)(5) (6) (7) (8) (9) (10) (11) (12)

Surnameandname Officeheld Plan N umber and Vesting Number and type Fair value at Vesting Granting date Market price at N umber and N umber and Value at the F air value (3) type o f P erio d of financial the granting P erio d the granting type o f type o f vesting date financial instruments date date financial financial (5) instruments (4) instruments instruments

Co-General Manager POLONISALVATORE Banco BPM

(I) Remuneration in companywhich draws up the financial statements 202.633

LTI (2017-2019) Ordinary 2017-2023 72.000 (8/04/2017) Shares of Banco BPM

N.D. N.D. 2018 (7/04/2018) 2018-2024 27/06/2019 N.D.202.181 80.873 80.873 (a) Ordinary Shares of OrdinaryShares of B anco BPM B anco BPM

14.142 7.071 2017 Ordinary 2017-2021 OrdinaryShares of 14.990 17.000 (8/04/2017) Shares of B anco BPM Banco BPM

3.050 3.051 2016 Ordinary former Bipiemme Group 2016-2020 OrdinaryShares of 6.468 9.342 Shares of (30/04/2016) B anco BPM Banco BPM

(II) Remuneration from subsidiaries and associates (III) Total 219.825 202.181 10.122 102.330 179.214

Director SAVIOTTIPIERFRANCESCO BANCOBPM

(I) Remuneration in companywhich draws up the financial statements 2015 10.230 former Banco Popolare Ordinary Shares Group 21.687 (g) B anco BPM (19/03/2016) (f)

(II) Remuneration from subsidiaries and associates (III) Total 10.230 21.687 Financial instruments FinancialinstrumentsassignedduringtheyearF inancial Financialinstruments F inancial assigned in previous instruments assigned during the year and instruments for the years and not vested vested grantable year during the financial year during the (1) (2) year and no t granted

(A) (B) (1) (2) (3) (4)(5) (6) (7) (8) (9) (10) (11) (12)

Surnameandname Officeheld Plan N umber and Vesting Number and type Fair value at Vesting Granting date Market price at N umber and N umber and Value at the F air value (3) type o f P erio d of financial the granting P erio d the granting type o f type o f vesting date financial instruments date date financial financial (5) instruments (4) instruments instruments

11OTHER EXECUTIVES WITH STRATEGIC RESPONSIBILITIES

(I) Remuneration in companywhich draws up the financial statements 300.198

LTI (2017-2019) Ordinary 2017-2023 106.667 (8/04/2017) Shares of Banco BPM

N.D. N.D. 2018 (7/04/2018) 563.127 2018-2022 27/06/2019 N.D. 337.876 337.876 (a) Ordinary Shares of OrdinaryShares of B anco BPM B anco BPM

30.500 15.249 2017 Ordinary 2017-2021 OrdinaryShares of 32.326 36.664 (8/04/2017) Shares of B anco BPM Banco BPM

7.585 7.585 2016 Ordinary former Bipiemme Group 2016-2020 OrdinaryShares of 16.079 23.229 Shares of (30/04/2016) B anco BPM Banco BPM

6.089 2015 former Bipiemme Group Ordinary Shares 12.908 18.789 (11/04/2015) B anco BPM (b)

12.422 16.171 2015 former Banco Popolare Ordinary Shares Ordinary Shares 34.281 (g) Group Banco BPM B anco BPM (19/03/2016) (f) (h) (f)

(II) Remuneration from subsidiaries and associates (III)Total 338.283 563.127 12.422 45.094 433.471 523.224 Notes:

(1) The shares will be effectively available to the beneficiaries at a later time after the retention period ends. (2) Participants in the long term incentive system (LTI) 2017-2019 system are not yet the legal owners of relative shares and will come into the ownership thereof following the outcome of verifications carried out during the vesting period. Said verifications may determine the reduction or even zeroing of shares: in 2020 verification of entry gates 2019 and performance levels achieved during the three-year period 2017-2019; in 2021, 2022 and 2023 verification, respectively, of consolidated entry gates 2020, 2021 and 2022. For accounting purposes, as the LTI system is configured as an "equity settled" plan, in accordance with accounting principle IFRS 2 "Share-based payments", an estimate has been made of the cost relating to the shares assigned, to be redistributed over the defined vesting period. The Fair Value reported in the "Fair Value of Financial Instruments for the year" refers to the relative portion estimated in the 2018 financial statements, entered under expenses for staff to offset a specific equity reserve. (3) For each plan, the date of the Shareholders' Meeting that approved it is specified. (4) Actual allocation will take place upon vesting of the relative up-front portion in cash(27/06/2019); the reference price will be equal to the arithmetic mean of official prices entered in the thirty calendar days preceding 27/06/2019. (5) For plans prior to 2018, the value is calculated at the official market price recorded on 28/02/2019 which is 2,1199 euro (a) Best estimate on date of Report publication, ex ante compared to any equalisation. Actual allocation will take place upon vesting of the relative up-front portion in cash(27/06/2019); the corresponding number of shares will be calculated based on the arithmetic mean of official prices entered in the thirty calendar days preceding 27/06/2019. (b) Recognised ordinary shares of former Banca Popolare di Milano Scarl have been converted into Banco BPM shares, in virtue of the merger with former Banco Popolare Soc. Coop., based on the value established for the share swap equal to 1 Banco BPM share for every 6.386 shares of the former Banco Popolare di Milano Scarl. (c) Approval date of the 2014 Remuneration Policies, following which the 2014 Incentive System was activated. (d) Following precautionary removal from service, portions vested during the year are not attributed and those yet to be vested will be assessed based on the outcome of investigations. (e) The fair value of financial instruments for the year was entered in financial statements insofar as precautionary removal occurred after the closure of the bank in question. (f) Recognised ordinary shares of the former Banco Popolare Soc. Coop. have been converted into Banco BPM shares, by virtue of the merger with the former Banca Popolare di Milano, based on the value established for the exchange of 1 Banco BPM share for every 1 share of the former Banco Popolare Soc. Coop. (g) The 2018 financial statements did not provide a fair value for the reference year of said plan insofar it was provided for in full in the 2015 financial statements. (h) It includes: (i) shares that will not be paid following termination in 2018 and (ii) shares vested during the financial year and not currently assigned, following the precautionary removal from the service. Table 3B: Monetary incentive plans for the members of the management board, general managers and other executives with strategic responsibilities (euro)

It is hereby specified that the issuing of amounts contained in the table will exclusively occur following ascertainment of predefined conditions of each single plan.

A B (1)(2) (3) (4) Surname and name Office held Plan Bonus of the year Bonus of previous years Other (1) Bonuses

(A) (B) (C) (A) (B) (C) Payable/ Deferred Deferral No longer Payable/ Paid Still Paid period payable Deferred Chief Executiv e Officer CASTAGNA GIUSEPPE BANCO BPM (I) Remuneration in the company which draws up the financial 2018 212.080 318.120 2019-2024 statements (7/04/2018) (a) 2017 34.800 139.200 (8/04/2017) 2016 former Bipiemme 135.00045.000 Group 2015 former Bipiemme 48.000 96.000 Group 2014 former Bipiemme Group 40.800 40.800 (12/04/2014) (b)

(II) Remuneration from subsidiaries and associates

(III) Total 212.080 318.120 168.600 411.000 A B (1)(2) (3) (4) Surname and name Office held Plan Bonus of the year Bonus of previous years Other (1) Bonuses

(A) (B) (C) (A) (B) (C) Payable/ Deferred Deferral No longer Payable/ Paid Still Paid period payable Deferred General Manager Banco FARONI MAURIZIO BPM (I) Remuneration in the company which draws up the financial 2017 statements (8/04/2017) 21.212 84.846 (c) 2015 Former Banco Popolare Group 85.808 (19/03/2016) (c)

(II) Remuneration from subsidiaries and associates

(III)Total 107.020 84.846

Co-General Manager DE ANGELIS DOMENICO BANCO BPM (I) Remuneration in the company which draws up the financial 2018 62.753 41.835 2019-2022 statements (7/04/2018) (a) 2017 34.00017.000 (8/04/2017)

2015 Former Banco 76.632 Popolare Group (19/03/2016)

(II) Remuneration from subsidiaries and associates

(III) Total 62.753 41.835 93.632 34.000 A B (1)(2) (3) (4) Surname and name Office held Plan Bonus of the year Bonus of previous years Other (1) Bonuses

(A) (B) (C) (A) (B) (C) Payable/ Deferred Deferral No longer Payable/ Paid Still Paid period payable Deferred Co-General Manager POLONI SALVATORE BANCO BPM (I) Remuneration in the company which draws up the financial 2018 80.873 121.309 2019-2024 statements (7/04/2018) (a) 2017 17.000 34.000 (8/04/2017) 2016 former Bipiemme 9.3429.342 Group

(II) Remuneration from subsidiaries and associates

(III) Total 80.873 121.309 26.342 43.342

Director SAVIOTTI PIER FRANCESCO BANCO BPM

(I) Remuneration in the company which draws up the financial 2015 statements Former Banco 146.240 Popolare Group (19/03/2016)

(II) Remuneration from subsidiaries and associates

(III) Total 146.240 A B (1)(2) (3) (4) Surname and name Office held Plan Bonus of the year Bonus of previous years Other (1) Bonuses

(A) (B) (C) (A) (B) (C) Payable/ Deferred Deferral No longer Payable/ Paid Still Paid period payable Deferred

11 OTHER EXECUTIVES WITH STRATEGIC RESPONSIBILITIES

(I) Remuneration in the company which draws up the financial 2018 337.876 225.251 2019-2022 statements (7/04/2018) (a) 2017 36.664 73.328 (8/04/2017) 2016 former Bipiemme 23.229 23.229 Group 2015 former Bipiemme 26.149 Group (11/04/2015)

2015 Former Banco 92.489 (d) 138.838 Popolare Group (19/03/2016) (II) Remuneration from subsidiaries and associates

337.876 225.251 Total92.489 224.879(III) 96.556

Notes: (1) For each plan, the date of the Shareholders' Meeting that approved it is specified. (a) Best estimate on date of Report publication, ex ante compared to any equalisation. (b) Approval date of the 2014 Remuneration Policies, following which the 2014 Incentive System was activated. (c) Following precautionary removal from service, portions vested during the year are not currently assigned, and the still deferred amounts will be verified basing on the outcome of investigations underway. (d) It includes: (i) amounts not payable following termination in 2018 and (ii) amounts not currently paid, following the precautionary removal from service. Tables complying with the provisions of CONSOB Resolution 11971/1999, as amended by CONSOB Resolution 18049/2011 (Annex 3A – Scheme 7-ter)

Schedule regarding information on shares held by members of management and supervisory boards, general managers and other executives with strategic responsibilities

In accordance with the criteria established in Annex 3A, scheme no. 7-ter of the Remuneration Report, the tables that follow show the shares held in Banco BPM S.p.A. and in the subsidiaries of the same, by members of the Board of Directors, of the Board of Statutory Auditors, by General Management and other executives with strategic responsibilities, as well as by spouses that are not legally separated and by children (minors), directly or through subsidiaries, trust companies or third parties, recorded in the shareholders’ register, in letters received and from other information acquired by the same members of the management and supervisory boards, General Management and other executives with strategic responsibilities.

Table 1 – Shares held by members of management and supervisory boards and general managers

Board of Directors NUMBER OF SHARES HELD ON NUMBER OF SHARES NUMBER OF SHARES NUMBER OF SHARES HELD ON 01/01/2018 (purchased/undersigned) SOLD/EXPIRED FROM 01/01/2018 31/12/2018 FROM 1/1/2018 TO 31/12/2018 TO 31/12/2018

Name and surname Office held INVESTEE COMPANY

INDIRECT DIRECT DIRECT INDIRECT DIRECT INDIRECT DIRECT INDIRECT OWNERSHIP (see OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP note 1)

Chairman of the Board of CARLO FRATTA PASINI Directors from 01/01/2018 Banco BPM - shares 280.406 58.375 - - - - 280.406 55,877 (a) to 31/12/2018

Senior Deputy Chairman of MAURO PAOLONI the Board of Directors from Banco BPM - shares 15 63 (a) - - - - 15 63 01/01/2018 to 31/12/2018

Deputy Chairman of the GUIDO CASTELLOTTI Board of Directors from Banco BPM - shares 4.565 42.000 - 4.000 4.000 - 565 46.000 01/01/2018 to 31/12/2018

Deputy Chairman of the MAURIZIO COMOLI Board of Directors from Banco BPM - shares 12.449 124.588 - - - - 12.449 124.588 01/01/2018 to 31/12/2018

Director from 01/01/2018 to 31/12/2018 GIUSEPPE CASTAGNA Chief Executive Officer Banco BPM - shares 271.432 - 89,597 (b) 500 - 500 361.029 - from 01/01/2018 to 31/12/2018

Director from 01/01/2018 to MARIO ANOLLI Banco BPM - shares 1.172 782 - - - - 1.172 782 31/12/2018

Director from 01/01/2018 to MICHELE CERQUA Banco BPM - shares 313 - - - - - 313 - 31/12/2018

Director from 01/01/2018 to RITA LAURA D'ECCLESIA Banco BPM - shares 500 - - - - - 500 - 31/12/2018

Director from 01/01/2018 to CARLO FRASCAROLO Banco BPM - shares 10.271 - - - - - 10.271 - 31/12/2018

271 Board of Directors (cont) NUMBER OF SHARES HELD ON NUMBER OF SHARES NUMBER OF SHARES NUMBER OF SHARES HELD ON 01/01/2018 (purchased/undersigned) SOLD/EXPIRED FROM 01/01/2018 31/12/2018 FROM 1/1/2018 TO 31/12/2018 TO 31/12/2018

Name and surname Office held INVESTEE COMPANY

INDIRECT DIRECT DIRECT INDIRECT DIRECT INDIRECT DIRECT INDIRECT OWNERSHIP (see OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP note 1)

Director from 01/01/2018 to PAOLA ELISABETTA MARIA GALBIATI Banco BPM - shares 327 1.565 - - - - 327 1.565 31/12/2018

Director from 01/01/2018 to CRISTINA GALEOTTI Banco BPM - shares 100 7.822 - - - - 100 7.822 31/12/2018

Director from 01/01/2018 to MARISA GOLO Banco BPM - shares 6.052 16.179.943 6.666 - - - 12.718 (a) 31/12/2018

Director from 01/01/2018 to PIERO SERGIO LONARDI Banco BPM - shares 59.359 138 20.000 - - - 79.359 138 31/12/2018

Director from 01/01/2018 to GIULIO PEDROLLO Banco BPM - shares 5.361 430.000 - - - - 5.361 430.000 31/12/2018

Director from 01/01/2018 to FABIO RAVANELLI Banco BPM - shares 243.257 116.042 75.000 - - - 318.257 116.042 31/12/2018

Director from 01/01/2018 to SAVIOTTI PIER FRANCESCO Banco BPM - shares 228.565 - 35.345 (c) - - - 263.910 - 31/12/2018

Director from 01/01/2018 to MANUELA SOFFIENTINI Banco BPM - shares 313 - - - - - 313 - 31/12/2018

Director from 01/01/2018 to COSTANZA TORRICELLI Banco BPM - shares 3.186 - - - - - 3.186 - 31/12/2018

Director from 01/01/2018 to CRISTINA ZUCCHETTI Banco BPM - shares 38.885 60.109 - - - - 38.885 60.109 31/12/2018

Notes: (a) indirect share possession changed following amendments to the subjective category criteria (natural and/or legal persons closely linked to the representative) in 2018. (b) shares allocated for the implementation of remuneration and incentive policies. (c) of which 15,345 allocated for the implementation of remuneration and incentive policies and no. 20,000 purchased.

272 Board of Statutory Auditors NUMBER OF SHARES HELD ON NUMBER OF SHARES NUMBER OF SHARES NUMBER OF SHARES HELD ON 01/01/2018 (purchased/undersigned) SOLD/EXPIRED FROM 01/01/2018 31/12/2018 FROM 1/1/2018 TO 31/12/2018 TO 31/12/2018

Nameandsurname Officeheld INVESTEECOMPANY

INDIRECT DIRECT DIRECT INDIRECT DIRECT INDIRECT DIRECT INDIRECT OWNERSHIP (see OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP note 1)

Chairman of the Board of PRIORI MARCELLO Statutory Auditors from Banco BPM - shares 11.997 1.930 - - - - 11.997 1.930 01/01/2018 to 31/12/2018

Standing Auditor from MARIA LUISA MOSCONI Banco BPM - shares 1.020 - - - - - 1.020 - 01/01/2018 to 31/12/2018

Standing Auditor from GABRIELE CAMILLO ERBA Banco BPM - shares 3.955 1.160 - - - - 3.955 1.160 01/01/2018 to 31/12/2018

Standing Auditor from ROSSI CLAUDIA Banco BPM - shares 1.000 - - - - - 1.000 - 01/01/2018 to 31/12/2018

Standing Auditor from ALFONSO SONATO Banco BPM - shares 30.305 25.673 - - - - 30.305 25.673 01/01/2018 to 31/12/2018

General Manager NUMBER OF SHARES HELD ON NUMBER OF SHARES NUMBER OF SHARES NUMBER OF SHARES HELD ON 01/01/2018 (purchased/undersigned) SOLD/EXPIRED FROM 01/01/2018 31/12/2018 FROM 1/1/2018 TO 31/12/2018 TO 31/12/2018

Nameandsurname Officeheld INVESTEECOMPANY

INDIRECT DIRECT DIRECT INDIRECT DIRECT INDIRECT DIRECT INDIRECT OWNERSHIP (see OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP note 1)

General Manager from MAURIZIO FARONI Banco BPM - shares 124.497 - 9,004 (*) - - - 133.501 - 01/01/2018 to 31/12/2018

Co-General Managers NUMBER OF SHARES HELD ON NUMBER OF SHARES NUMBER OF SHARES NUMBER OF SHARES HELD ON 01/01/2018 (purchased/undersigned) SOLD/EXPIRED FROM 01/01/2018 31/12/2018 FROM 1/1/2018 TO 31/12/2018 TO 31/12/2018

Nameandsurname Officeheld INVESTEECOMPANY

INDIRECT DIRECT DIRECT INDIRECT DIRECT INDIRECT DIRECT INDIRECT OWNERSHIP (see OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP note 1)

Co-General Manager from DOMENICO DE ANGELIS Banco BPM - shares 76.731 1.058 8,041 (*) - - - 84.772 1.058 01/01/2018 to 31/12/2018

Co-General Manager from SALVATORE POLONI Banco BPM - shares ------01/01/2018 to 31/12/2018

Notes: (*) shares allocated for the implementation of remuneration and incentive policies.

1) indirect ownership (meaning scope set forth in provisions contained in Art. 84-quater of the Issuers’ Regulation adopted by CONSOB with Resolution 11971 of 14th May 1999 as amended, as well as, prudentially, by the provisions contained in European Regulation no. 596/2014-Market Abuse Regulation, "MAR").

The significant indirect relationships for the REPRESENTATIVE are shown below for the purpose of the above- cited legislation:

Natural persons: the spouse, not legally separated, or a partner that is the equivalent of a spouse under national law, dependent children and—if they have been living together for at least one year—parent, relatives and equivalent (CLOSELY RELATED PERSONS). At present, pursuant to Article 12 of Italian 273 Presidential Decree 917/86, family members with total income not exceeding the threshold established in the second paragraph of said article, specifically no greater than 2,840.51 euro, before deductible costs, are considered dependent.

Legal entities: a) legal entities, partnerships and trusts controlled directly or indirectly by the REPRESENTATIVE or by a CLOSELY RELATED PERSON (control means the categories set forth in article 2359, paragraphs 1 and 2 of the Italian Civil Code); b) the legal entities, partnerships and trusts whose economic interests are substantially equivalent to those of the REPRESENTATIVE or of the CLOSELY RELATED PERSON (circumstances in which the REPRESENTATIVE holds, alone or with a CLOSELY RELATED PERSON, a share exceeding 50% of profits); c) legal entities, partnerships and trusts: (i) the management responsibility for which is held by the REPRESENTATIVE or by a CLOSELY RELATED PERSON (to this end, this includes the positions of: Sole Director; Director with mandates; General Manager; Co-General Manager; Deputy General Manager or Partner of a Partnership); (ii) set up for the benefit of the REPRESENTATIVE or a CLOSELY RELATED PERSON; d) the legal entities, partnerships and trusts in which the REPRESENTATIVE or a CLOSELY RELATED PERSON is the owner, alone or jointly between them, of the management function (the position of Sole Director is valid for this purpose. In the case of more than one director, the REPRESENTATIVE is the owner of the management function in the event in which over half of the board is comprised of the REPRESENTATIVE and/or by CLOSELY RELATED PERSONS).

274 Table 2 – Shares held by other executives with strategic responsibilities

NUMBER OF SHARES NUMBER OF SHARES NUMBER OF SHARES NUMBER OF SHARES HELD ON HELDON 01/01/2018 (purchased/undersigned) SOLD/EXPIRED FROM 01/01/2018 31/12/2018 and/or date of appointment FROM 01/01/2018 (and/or from (and/or from date of date of appointment) TO appointment) TO 31/12/2018 31/12/2018 OTHER EXECUTIVES WITH STRATEGIC RESPONSIBILITIES (see INVESTEE COMPANY note 2)

INDIRECT DIRECT DIRECT INDIRECT DIRECT INDIRECT DIRECT INDIRECT OWNERSHIP( OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP OWNERSHIP see note 1)

11 Banco BPM - shares 97.614 355 88,766 (*) - 6.153 - 180.227 355

Notes: (*) of which 76,266 shares allocated for the implementation of remuneration and incentive policies

1) indirect ownership (meaning scope set forth in provisions contained in art. 84-quater of the Issuers’ Regulation adopted by CONSOB with Resolution 11971 of 14th May 1999 as amended, as well as, prudentially, by the provisions contained in European Regulation no. 596/2014-Market Abuse Regulation, "MAR").

The significant indirect relationships for the REPRESENTATIVE are shown below for the purpose of the above-cited legislation:

Natural persons: the spouse, not legally separated, or a partner that is the equivalent of a spouse under national law, dependent children and—if they have been living together for at least one year—parent, relatives and equivalent (CLOSELY RELATED PERSONS). At present, pursuant to Article 12 of Italian Presidential Decree 917/86, family members with total income not exceeding the threshold established in the second paragraph of said article, specifically no greater than 2,840.51 euro, before deductible costs, are considered dependent.

Legal entities: a) legal entities, partnerships and trusts controlled directly or indirectly by the REPRESENTATIVE or by a CLOSELY RELATED PERSON (control means the categories set forth in article 2359, paragraphs 1 and 2 of the Italian Civil Code); b) the legal entities, partnerships and trusts whose economic interests are substantially equivalent to those of the REPRESENTATIVE or of the CLOSELY RELATED PERSON (circumstances in which the REPRESENTATIVE holds, alone or with a CLOSELY RELATED PERSON, a share exceeding 50% of profits); c) legal entities, partnerships and trusts: (i) the management responsibility for which is held by the Representative or by a Closely Related Person (to this end, this includes the positions of: Sole Director; Director with mandates; General Manager; Co-General Manager; Deputy General Manager or Partner of a Partnership); (ii) set up for the benefit of the REPRESENTATIVE or a CLOSELY RELATED PERSON; d) the legal entities, partnerships and trusts in which the Representative or a Closely Related Person is the owner, alone or jointly between them, of the management function (the position of Sole Director is valid for this purpose. In the case of more than one director, the REPRESENTATIVE is the owner of the management function in the event in which over half of the board is comprised by the REPRESENTATIVE and/or CLOSELY RELATED PERSONS).

2) These are 11 Executives with strategic responsibilities including the Chief Financial Officer, the Head of the Audit Function, the Head of the Risk Function, the Head of the Compliance Function, 5 of which for a part of the year.

275 Glossary The definition of some of the technical terms used in this public disclosure document is provided below.

Backtesting Retrospective tests conducted to verify the predictive capacity of the risk estimation models.

Banking book With the introduction of accounting standard IFRS 9, accounting portfolios falling under the definition of the "banking book" perimeter are the following: financial assets designated at fair value, other financial assets obligatorily designated at fair value, financial assets designated at fair value through other comprehensive income and financial assets designated at amortised cost. Most transactions pass through the banking book (loans), deposits) on average - deposits. This may contain instruments held for sale such as instrumental equity investments or held to maturity, instruments representing financing, loans and/or bonds, or bonds those not listed on an active market.

Securitisation Transaction to transfer the risk relating to financial or real assets to a special purpose vehicle, performed through sale of the underlying asset or through use of derivative contracts.

Additional Tier 1 Capital Additional Tier 1 capital consists of capital instruments other than ordinary shares which comply with all requirements established by regulations.

Tier 1 Capital Tier 1 capital is equal to the sum of Common Equity Tier 1 and Additional Tier 1 capital.

Tier 2 Capital Tier 2 capital includes capital instruments and subordinated loans that satisfy the requirements established by regulations, the relative share premiums, the excess of overall value adjustments with respect to expected losses and other elements constituting lower quality capital.

Common Equity Tier 1 Capital Common Equity Tier 1 capital includes paid-up capital, capital instruments that satisfy the requirements established by regulations, the relative share premiums, profit reserves, net of treasury shares held, goodwill, other intangible assets and the excess of overall value adjustments with respect to expected losses. CET 1 - Common Equity Tier 1 ratio Ratio between Common Equity Tier 1 and total risk-weighted assets.

Corporate Customer segment corresponding to medium and large-sized enterprises. 276 Credit default swap/option Contract by which, against payment of a premium, one person transfers to another the credit risk pertaining to a loan or a security, upon occurrence of a certain event linked to deterioration of the debtor’s degree of solvency (for options, the purchaser of the option also has the right to choose whether to exercise it or not).

Credit derivatives Derivative contracts of which the effect is to transfer credit risks. These are products that allow the investors to engage in arbitrage and/or market hedging of receivables, mainly using instruments other than cash, take on credit exposures that are diversified in duration and intensity, amend the risk profile of a portfolio and separate credit risks from other market risks.

Past due loan Past dues are impaired exposures that are past due and/or have exceeded credit lines on a continuous basis in accordance with the definition set forth in current supervisory reports.

CRM – Credit Risk Mitigation Credit risk mitigation techniques, usually collateral or personal guarantees.

Default Condition of declared impossibility of honouring debts and/or payment of related interest.

EAD - Exposure At Default Estimate of the future value of an exposure at the time of debtor default. The banks that meet requirements for adopting the IRB Advanced approach are authorised to estimate the EAD, while the others must use regulatory estimates.

Expected loss Amount of losses expected on loans in a one-year time horizon. For a loans portfolio, the expected loss represents the average value of distribution of losses.

Fair value Consideration at which an asset may be exchanged or a liability discharged, in an arm’s length transaction between two informed and independent parties.

Prudential filters In the contest of methods for calculating own funds (supervisory capital), prudential filters are those amendments made to balance-sheet items in order to safeguard the quality of the own funds and to reduce its potential volatility induced by application of the international “IAS/IFRS” accounting standards.

Floor A "floor" is any minimum level of capital requirement which the relevant authorities introduce at a general or specific level, also in the context of authorisation proceedings.

277 As of 31.12.2017 the effects of article 500 Regulation CRR were no longer effective which, for entities that calculate the amounts of weighted exposures using internal models or advanced measurement approaches, required a capital floor relative to total requirements calculated on the basis of the regulatory provisions in effect at the end of 2006 ( "Basel 1").

Own Funds The total of Own Funds is the set of capital items for covering risks and corporate losses. This consists of the sum of Tier 1 capital and Tier 2 capital.

IAS/IFRS The IAS (International Accounting Standards) are international accounting standards issued by the International Accounting Standards Board (IASB). The standards issued after July 2002 are called IFRS (International Financial Reporting Standards).

ICAAP Process for determining the appropriate level of internal capital to cover every type of risk, including those not covered by the total capital requirement (“Pillar ”), as part of a current and perspective assessment that takes both corporate strategies and developments in the macroeconomic context into account. The process is governed by “Pillar 2” (Circular 285).

ILAAP Internal liquidity adequacy assessment process, with reference to the processes of identification, measurement, management and monitoring of internal liquidity carried out by the entity.

IMA – Internal Models Approach Internal model used to calculate the minimum capital requirements for the Market Risk.

IRB - Internal Rating Based Internal rating based approach for calculating capital requirements for the Credit Risk, which is divided into basic and advanced approaches. In the advanced approach, all the input estimates (PD, LGD, EAD) for assessing the credit risk are performed internally. In the basic approach (FIRB), only the PD is estimated by the Bank.

Junior In a securitisation transaction, this is the most subordinate tranche of the securities issued (Equity tranche), which is the first to incur the losses that may occur in recovery of the underlying assets.

LGD - Loss Given Default Estimated rate of loss in the event of debtor default.

Mezzanine In a securitisation transaction, this is the tranche with the intermediate degree of subordination between the junior tranche and the senior tranche.

278 PD - Probability of Default Probability that the debtor will default over a one-year time horizon.

Rating Assessment of the quality of a company or of its debt security issues on the basis of its financial soundness and its prospects. The assessment may be performed by specialised agencies or by the bank on the basis of internal models.

Retail Customer category that mainly includes private parties, professionals, traders and artisans.

Credit risk Risk that an unexpected change in the creditworthiness of trusted counterparties causes said counterparties to default, producing unforeseen losses with regard to cash and endorsement exposures.

Counterparty Risk Risk that a counterparty in a transaction involving certain instruments (OTC financial and credit derivatives, repurchase agreements, securities/commodities lending, loans with margins, etc.) should default before final settlement of the transaction’s financial flows.

Market risk Risk of loss generated by the transaction on markets concerning financial instruments (of the trading book for regulatory purposes and the banking book), currencies and commodities, deriving from the trend in the market factors or the issuer’s situation.

Operational risk The risk of suffering losses caused by inadequacy or failure attributable to procedures, human resources and internal systems, or caused by external events. This type of risk includes losses arising from fraud, human error, interruption of operating activity, system unavailability, contractual default, natural disasters. Operational risk also includes legal risk, but excludes strategic and reputational risk.

Liquidity risk Risk that the bank is unable to honour its obligations upon maturity. For internal purposes to support the ICAAP processes, it is defined as Risk of incurring non-market financing costs with regard to an imbalanced net financial position.

Risk Appetite Framework The reference framework which defines - in line with the maximum risk that can be assumed, the business model and the strategic plan - the risk appetite, tolerance thresholds, risk limits and risk governance policies as well as the reference processes needed to define and implement them in compliance with the provisions of the Supervisory Instructions.

RWA - Risk Weighted Assets Cash and off-balance sheet assets classified and weighted according to different risk-linked ratios, pursuant to banking law. 279 Senior/super senior In a securitisation transaction, this is the tranche with the highest degree of privilege in terms of return and repayment.

Sensitivity Identifies the sensitivity with which certain assets or liabilities react to changes in rates or in other reference parameters.

SPE/SPV Special Purpose Entities or Special Purpose Vehicles are companies that have been specially established by one or more parties for performing a specific transaction. SPE/SPV generally do not have their own operating and management structures but use those of the other players involved in the transaction.

Spread Spread generally refers to the difference between two interest rates, the spread between bid and ask prices in security trading or the increased charge that the issuer of securities recognises in addition to the reference rate.

Stress test Stress tests are understood to be quantitative and qualitative techniques by means of which the bank assesses its vulnerability to exceptional but plausible events. The stress tests verify the effects on the risks of the bank due to specific events (sensitivity analysis) or joint changes in a series of economic-financial variables in cases of adverse scenarios (scenario analysis), with reference to individual risks (specific stress) or in an integrated manner on several risks (joint stress).

Tier 1 ratio Ratio between Tier 1 capital and total risk-weighted assets.

Total capital ratio Ratio between total own funds and total risk-weighted assets.

Trading book This is the bank’s “regulatory trading book”, that is, all the positions taken with customers for treasury or trading purposes and intentionally destined, in the short term, to subsequent disposal for the purpose of benefiting from the profits arising from the difference between the purchase and sale price.

VaR - Value at Risk Probabilistic measure of the maximum potential loss that an intermediary can incur within a certain confidence interval and in a given time horizon.

280 Declaration of the Risk Unit Manager

The undersigned Carlo Palego, in his capacity as Manager of the Parent Company Banco BPM SpA’s Risk Unit, attests that the annual Public Disclosure Document (Pillar 3) at 31/12/2018 was prepared in accordance with the reference legislation (Bank of Italy Circular no. 285/2013 and the CRR Regulation, EU no. 575/2013), taking into account the business model and the Bank’s organisational structure, also with reference to other national and international banking groups with comparable dimensions and complexity. He also notes that the whole Document was prepared in accordance with the Public Disclosure Template defined by the Group for financial year 2019.

Milan, 12 March 2019

Risk Unit Manager Carlo Palego (signed)

281 Declaration of the Financial Reporting Manager

The undersigned, Gianpietro Val, in his capacity as Financial Reporting Manager of Banco BPM S.p.A, hereby declares, in compliance with the provisions of article 154-bis, paragraph 2 of Italian Legislative Decree no. 58 of 24 February 1998, that the accounting information contained in this document is consistent with the records contained in the corporate documents, books and accounting records.

Milan, 12 March 2019

Financial Reporting Manager Gianpietro Val (signed)

282